Suppress the use of host key in SFTP or SCP using WinSCP

Question

I am working on an application in which I am downloading files using WinSCP .NET assembly (version 5.5.0.3839)

My code to download file is given below

public bool ReceiveFile(string ftpFilePath,out String downloadedFileName, String DestinationPath)
{
    bool sendingStatus = false;
    downloadedFileName = string.Empty;
    try
    {
        if (sessionOptions != null)
        {
            using (Session session = new Session())
            {
                // Connect
                bool isSessionOpened = OpenSession(session);
                if (isSessionOpened)
                {
                    // Upload files
                    TransferOptions transferOptions = new TransferOptions();
                    transferOptions.TransferMode = TransferMode.Automatic;

                    TransferOperationResult transferResult;
                    transferResult = session.GetFiles(ftpFilePath, DestinationPath, false, transferOptions);
                    // Throw on any error
                    transferResult.Check();

                    // Print results
                    foreach (TransferEventArgs transfer in transferResult.Transfers)
                    {
                        sendingStatus = true;
                        downloadedFileName = transfer.FileName;
                        //We are breaking here because we are assuming that for one import batch setup only one file will be downloaded
                        break;
                    }
                }
            }
        }
    }
    catch (Exception ex)
    {
    }
    return sendingStatus;
}

FTP is working fine, but working with SFTP it requires host key.

When I worked with WinSCP application directly it warns for the host key and user is able to copy host key by clicking on "Copy key" button.

Host key will be copied to clipboard and we can use this key to download files from SFTP or SCP.

There is also an option that user can suppress the use of host key.

I want to suppress the use of host key programmatically.

Let me know if there required any other information.

Martin Prikryl · Accepted Answer · 2023-01-03T07:06:20.483

What do you mean by "suppress the use of host key"?

There's no option to suppress use of the host key in WinSCP application. You have an option to accept the host key and remember it, to accept the key without remembering it, and to reject the key (and abandon the connection).
https://winscp.net/eng/docs/ssh_verifying_the_host_key

The WinSCP .NET assembly does not have the first option built-in, as it (by default) does not keep any configuration, so it cannot store the accepted keys anywhere. That's by design. It's your task to set the SessionOptions.SshHostKeyFingerprint. Either:

hard-code the host key fingerprint;
or load it from any configuration your application have (i.e. possibly from the same configuration you load host name or user name);
or cache known host keys (by setting SessionOption.SshHostKeyPolicy to SshHostKeyPolicy.AcceptNew or by explicitly implementing your own cache.
or, if you do not care about the host key (meaning you do not care about security at all), you can make WinSCP accept any host key unconditionally by setting SessionOption.SshHostKeyPolicy to SshHostKeyPolicy.GiveUpSecurityAndAcceptAny.

But that's for use in exceptional situations only, where SSH security is unnecessary overhead. Like when both your application and server are within an isolated network.

See also WinSCP .NET library: Connect to SFTP server without specifying SSH host key fingerprint.

Your code does not show implementation of OpenSession, what is a key piece here, so it's not clear what you are trying to do.

Suppress the use of host key in SFTP or SCP using WinSCP

1 Answers1

Linked