Bug #75764 SSH tunneling ignores the user-specific SSH configuration
Submitted: 4 Feb 2015 14:37 Modified: 19 Mar 2015 5:24
Reporter: Danny Fallon Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Workbench Severity:S3 (Non-critical)
Version:6.2.4 OS:Mac OS X (10.10.2)
Assigned to: CPU Architecture:Any
Tags: ssh config

[4 Feb 2015 14:37] Danny Fallon
Description:
We operate a cluster of SSH tunnel boxes under the same DNS name using a load balancer. To get around known host key mismatches we have the following added to our ~/.ssh/config files:

-------------
Host tunnel.production.site.com
 User ec2-user
 UserKnownHostsFile /dev/null
 StrictHostKeyChecking=no
-------------

These options, while not the most secure, allow us to maintain the setup. mySQL Workbench does not read this configuration file when setting up SSH tunnels, so I find myself getting host key mismatches and having to clear out the ~/ssh/known_hosts file regularly to get a connection.

How to repeat:
Copy the ssh config from the description (changing the host name) to ~/.ssh/config

Connect to the SSH host

Find a key has been added to ~/.ssh/known_hosts

Suggested fix:
It appears that the paramiko library supports SSHConfigs, so I think you should try parsing ~/.ssh/config and apply the settings before trying to establish a connection.

https://gist.github.com/acdha/6064215
http://www.saltycrane.com/blog/2010/02/python-paramiko-notes/
[5 Mar 2015 11:27] Marcin Szalowicz
Thank you for the bug report.
[19 Mar 2015 5:24] Philip Olson
Posted by developer:
 
Fixed as of the upcoming MySQL Workbench 6.3.3 release, and here's the changelog entry:

The "StrictHostKeyChecking" and "UserKnownHostsFile" variables are now
read from the SSH configuration file when using SSH for a MySQL connection. 

MySQL Workbench will attempt to load this
configuration from the following locations: For Windows,
"%APPDATA%\MySQL\Workbench\ssh\ssh_config" or
"%APPDATA%\MySQL\Workbench\ssh\config". For Linux and OS X,
"~/.ssh/ssh_config" or "~/.ssh/config".

Thank you for the bug report.