Handling Host Key Change

[Clifra-Jones]

We interact with one of out vendors SFTP servers to run schedule jobs that retrieve files. The problem we are running into is that they will do things that cause the host key to change. We are using the -AcceptKey parameter on New-SFTPSession and that works well on the initial connection to the server. What happens is when they make a change and the server has a new host key the connection fails until I remove the old host entry from hosts,json.

I know that this is probably not the best approach re: security but is there any way to accept the new key and overwrite the old host entry? They never tell us when this happens and it causes critical management reporting to fail.

[MVKozlov]

afair -Force does not check key at all
if you want accept any key, why bother checking it at all ? :)

[DarkLite1]

We created this wrapper script for transferring files over SFTP, where we also ignore the host key for the same reasons you do.

Here's the relevant code:

$params = @{
    ComputerName      = $SftpComputerName
    Credential        = $sftpCredential
    Port              = $SftpPort
    ConnectionTimeout = 60
    AcceptKey         = $true
    Force             = $true
    Verbose           = $false
}

if ($SftpOpenSshKeyFile) {
    $params.KeyString = $SftpOpenSshKeyFile
}

$sftpSession = New-SFTPSession @params

Feel free to use the wrapper script if you want. Simply create a .JSON input file and you're good to go.