sshutil

func TOFUHostKeyCallback ¶

func TOFUHostKeyCallback() ssh.HostKeyCallback

TOFUHostKeyCallback returns an ssh.HostKeyCallback implementing a Trust-On-First-Use (TOFU) pattern for SSH host key verification. On first connection to a host, the key is recorded in a holodeck-specific known_hosts file at $CACHE/holodeck/known_hosts (where $CACHE is os.UserCacheDir). On subsequent connections the stored key is compared and a mismatch — indicating a potential MITM attack — is rejected with an error.