Support for SSH feature

Core Tunnel Request Feature
1

Hi, could we please have support added for NoHostAuthenticationForProxyCommand in advanced connection settings?

This would help immensely with proxy commands that resolve dynamic instances

2

Hi Dan,

Thanks for the feature request!

Before considering this, I'd like to better understand your use case.

Could you share which ProxyCommand tool or script you're using, and how it handles dynamic instances?

In particular, are you encountering host key verification errors because each connection may be routed to a different backend instance, or is there another reason you need to disable host authentication?

Yang

3

Hi Yang,

Thanks for the quick response. In my use case, we use cloud instances identified by tags. The instances are ephemeral, so they rotate fairly frequently, and I use a proxy command which resolves the current active instance to connect.

When the instances rotate, we're left with invalid entries in known hosts. For plain SSH cli connections, setting NoHostAuthenticationForProxyCommand yes in config means we can ignore the spurious entries, but I can't find an equivalent way in CoreTunnel to do that (so I have to manually remove the known hosts entries every time the instances rotate)

4

Thanks for explaining your setup. I think there may be another approach worth considering.

You can configure a dedicated known_hosts file for this profile, so the host keys of your dynamic instances are isolated from those of your other SSH hosts.

For example:

UserKnownHostsFile ~/.ssh/known_hosts_dynamic
StrictHostKeyChecking no

This allows SSH to accept changed host keys when instances are rotated, without affecting the known_hosts entries used by your other connections.

If you prefer to retain strict host key verification, you can also use a dedicated known_hosts file together with StrictHostKeyChecking yes, provided you have a way to update that file with the new instances' trusted host keys.

Another option is to use /dev/null as the known_hosts file:

UserKnownHostsFile /dev/null
StrictHostKeyChecking no

This means SSH won't persist host keys or check them against previously saved entries. New or changed host keys will be accepted without requiring manual intervention.

The main advantage is that this configuration is isolated to this profile and doesn't affect the known_hosts entries of your other SSH connections.

Please note the security implications: this effectively disables host key verification for this profile. The risk is essentially the same as using NoHostAuthenticationForProxyCommand yes, since neither approach provides reliable protection against connecting to an impersonated server or a man-in-the-middle attack.

If you're comfortable with this trade-off for your ephemeral cloud instances, this should be a simple alternative.

Would this approach work for your setup?

5

Hi Yang, yes that's also a viable workaround. This request can be closed!

Thanks