Fixes
- Fix SSH config to allow either a public key or known hosts file to be set- #885
#885 (thanks @J4kubS)
Important note for users using the SSH backend
Previous versions (v2.49.1 and below) contained a vulnerability, where the SSH host's identity was never validated when transferring archives. This could potentially leak backup content or SSH passwords. See this security advisory for further details (thanks to @lml20000827 for disclosing). Updating to this version therefore is highly recommended and requires one of the following configuration updates:
- provide the host's public key by setting either
SSH_HOST_PUBLIC_KEY(the key's content) orSSH_HOST_PUBLIC_KEY_FILE(the fs location of the key in a file) - provide the location of a valid known_hosts file by setting
SSH_KNOWN_HOSTS_FILE - dangerously set
SSH_INSECURE_IGNORE_HOST_KEYto ignore host key checks
Any update to this version without changed configuration will bail early without any backup creation or SSH connection taking place.