MySQL Bugs: #75764: SSH tunneling ignores the user-specific SSH configuration

Bug #75764	SSH tunneling ignores the user-specific SSH configuration
Submitted:	4 Feb 2015 14:37	Modified:	19 Mar 2015 5:24
Reporter:	Danny Fallon	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Workbench	Severity:	S3 (Non-critical)
Version:	6.2.4	OS:	MacOS (10.10.2)
Assigned to:		CPU Architecture:	Any
Tags:	ssh config

Description:
We operate a cluster of SSH tunnel boxes under the same DNS name using a load balancer. To get around known host key mismatches we have the following added to our ~/.ssh/config files:

-------------
Host tunnel.production.site.com
 User ec2-user
 UserKnownHostsFile /dev/null
 StrictHostKeyChecking=no
-------------

These options, while not the most secure, allow us to maintain the setup. mySQL Workbench does not read this configuration file when setting up SSH tunnels, so I find myself getting host key mismatches and having to clear out the ~/ssh/known_hosts file regularly to get a connection.

How to repeat:
Copy the ssh config from the description (changing the host name) to ~/.ssh/config

Connect to the SSH host

Find a key has been added to ~/.ssh/known_hosts

Suggested fix:
It appears that the paramiko library supports SSHConfigs, so I think you should try parsing ~/.ssh/config and apply the settings before trying to establish a connection.

https://gist.github.com/acdha/6064215
http://www.saltycrane.com/blog/2010/02/python-paramiko-notes/

Thank you for the bug report.

Posted by developer:
 
Fixed as of the upcoming MySQL Workbench 6.3.3 release, and here's the changelog entry:

The "StrictHostKeyChecking" and "UserKnownHostsFile" variables are now
read from the SSH configuration file when using SSH for a MySQL connection. 

MySQL Workbench will attempt to load this
configuration from the following locations: For Windows,
"%APPDATA%\MySQL\Workbench\ssh\ssh_config" or
"%APPDATA%\MySQL\Workbench\ssh\config". For Linux and OS X,
"~/.ssh/ssh_config" or "~/.ssh/config".

Thank you for the bug report.