Remove instructions to disable SSH HostKeyChecking or clarify use.

Created by: Nilos

https://github.com/gitlabhq/gitlabhq/blob/stable/doc/install/installation.md#disable-stricthostkeychecking-for-localhost-and-your-domain

This part tells everyone to disable stricthostkeychecking, which is there for a good reason: to prevent man in the middle attacks.

There should at least be a part explaining why this should be disabled. It would be best to just remove it, as I could not find any reason to do so.

Created by: dzaporozhets

It disable strict check only for domain you trust. It requires to successfully clone repos by application during running without promt you to add your domain to known_hosts

By Administrator on 2013-01-16T21:21:54 (imported from GitLab)

Created by: Nilos

It definitly destroys all protection against man in the middle attacks. As soon as this option is disabled, you have no chance at all to realize if somebody is using a man in the middle attack against your connection. If you have accepted a ssh key, there is no prompt if the key does not change.

By Administrator on 2013-01-16T21:27:50 (imported from GitLab)

Created by: dzaporozhets

I expect you suggest a better solution. Like run ssh on setup to every domain name and accept an ssh key?

sudo -u gitlab -H ssh git@domainname
sudo -u gitlab -H ssh git@localhost
sudo -u gitlab -H ssh git@gitolitehost

By Administrator on 2013-01-16T21:48:36 (imported from GitLab)

Created by: Nilos

There should at least be some sentence about the risk those settings impose and about a possible workaround like, yes, adding every domains host key on setup (you could even do that manually)

The problem is, what a lot of people do is, they go to one of their servers and from there they ssh to the next and so on. If they now use your settings and somebody is eavesdropping they have got a huge problem.

I am not sure if there is another possibility like seting git up to pass those parameters to the ssh call directly.

By Administrator on 2013-01-16T22:00:14 (imported from GitLab)

Created by: riyad

+1 we should add a better explanation and a warning

By Administrator on 2013-01-17T00:12:10 (imported from GitLab)

Created by: 0xBF

Why we disable host key checking globally in /etc/ssh/ssh_config? Why not in ~gitlab/.ssh/config?

By Administrator on 2013-01-17T08:09:45 (imported from GitLab)

Created by: dzaporozhets

I fill fix it today

By Administrator on 2013-01-17T09:51:30 (imported from GitLab)

Created by: dzaporozhets

Fixed by 7e40684b

By Administrator on 2013-01-17T09:58:19 (imported from GitLab)