chore: support UseInsecureCipher (#158)

Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>

.drone.yml

@@ -9,7 +9,7 @@ platform:
 steps:
 - name: vet
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - make vet
   volumes:
@@ -18,7 +18,7 @@ steps:
 
 - name: lint
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - make lint
   volumes:
@@ -27,7 +27,7 @@ steps:
 
 - name: misspell
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - make misspell-check
   volumes:
@@ -36,7 +36,7 @@ steps:
 
 - name: test
   pull: always
-  image: golang:1.13-alpine
+  image: golang:1.14-alpine
   commands:
   - apk add git make curl perl bash build-base zlib-dev ucl-dev
   - make ssh-server
@@ -68,7 +68,7 @@ platform:
 steps:
 - name: build-push
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - go build -v -ldflags '-X main.build=${DRONE_BUILD_NUMBER}' -a -o release/linux/amd64/drone-ssh
   environment:
@@ -80,7 +80,7 @@ steps:
 
 - name: build-tag
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - go build -v -ldflags '-X main.version=${DRONE_TAG##v} -X main.build=${DRONE_BUILD_NUMBER}' -a -o release/linux/amd64/drone-ssh
   environment:
@@ -91,7 +91,7 @@ steps:
 
 - name: executable
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - ./release/linux/amd64/drone-ssh --help
 
@@ -147,7 +147,7 @@ platform:
 steps:
 - name: build-push
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - go build -v -ldflags '-X main.build=${DRONE_BUILD_NUMBER}' -a -o release/linux/arm64/drone-ssh
   environment:
@@ -159,7 +159,7 @@ steps:
 
 - name: build-tag
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - go build -v -ldflags '-X main.version=${DRONE_TAG##v} -X main.build=${DRONE_BUILD_NUMBER}' -a -o release/linux/arm64/drone-ssh
   environment:
@@ -170,7 +170,7 @@ steps:
 
 - name: executable
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - ./release/linux/arm64/drone-ssh --help
 
@@ -226,7 +226,7 @@ platform:
 steps:
 - name: build-push
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - go build -v -ldflags '-X main.build=${DRONE_BUILD_NUMBER}' -a -o release/linux/arm/drone-ssh
   environment:
@@ -238,7 +238,7 @@ steps:
 
 - name: build-tag
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - go build -v -ldflags '-X main.version=${DRONE_TAG##v} -X main.build=${DRONE_BUILD_NUMBER}' -a -o release/linux/arm/drone-ssh
   environment:
@@ -249,7 +249,7 @@ steps:
 
 - name: executable
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - ./release/linux/arm/drone-ssh --help
 
@@ -305,7 +305,7 @@ platform:
 steps:
 - name: build-all-binary
   pull: always
-  image: golang:1.13
+  image: golang:1.14
   commands:
   - make release
   when:

DOCS.md

@@ -139,6 +139,23 @@ Example configuration for stoping script after first failure:
         - echo "you can't see the steps."
 ```
 
+Example configuration for passphrase which protecting a private key:
+
+```diff
+  - name: ssh commands
+    image: appleboy/drone-ssh
+    settings:
+      host: foo.com
+      username: root
++     key:
++       from_secret: ssh_key
++     passphrase: 1234
+      port: 22
+      script:
+        - mkdir abc/def/efg
+        - echo "you can't see the steps."
+```
+
 ## Secret Reference
 
 ssh_username
@@ -147,6 +164,9 @@ ssh_username
 ssh_password
 : password for target host user
 
+ssh_passphrase
+: The purpose of the passphrase is usually to encrypt the private key.
+
 ssh_key
 : plain text of user private key
 
@@ -156,6 +176,9 @@ proxy_ssh_username
 proxy_ssh_password
 : password for user of proxy server
 
+proxy_ssh_passphrase
+: The purpose of the passphrase is usually to encrypt the private key.
+
 proxy_ssh_key
 : plain text of user private key for proxy server
 

Makefile

@@ -9,7 +9,6 @@ DEPLOY_IMAGE := $(EXECUTABLE)
 
 TARGETS ?= linux darwin windows
 ARCHS ?= amd64 386
-PACKAGES ?= $(shell $(GO) list ./...)
 SOURCES ?= $(shell find . -name "*.go" -type f)
 TAGS ?=
 LDFLAGS ?= -X 'main.Version=$(VERSION)'
@@ -32,7 +31,7 @@ fmt:
 	$(GOFMT) -w $(SOURCES)
 
 vet:
-	$(GO) vet $(PACKAGES)
+	$(GO) vet ./...
 
 lint:
 	@hash revive > /dev/null 2>&1; if [ $$? -ne 0 ]; then \
@@ -64,7 +63,7 @@ fmt-check:
 	fi;
 
 test: fmt-check
-	@$(GO) test -v -cover -coverprofile coverage.txt $(PACKAGES) && echo "\n==>\033[32m Ok\033[m\n" || exit 1
+	@$(GO) test -v -cover -coverprofile coverage.txt ./... && echo "\n==>\033[32m Ok\033[m\n" || exit 1
 
 install: $(SOURCES)
 	$(GO) install -v -tags '$(TAGS)' -ldflags '$(EXTLDFLAGS)-s -w $(LDFLAGS)'
@@ -118,16 +117,18 @@ endif
 	docker push $(DEPLOY_ACCOUNT)/$(DEPLOY_IMAGE):$(tag)
 
 ssh-server:
-	adduser -h /home/drone-scp -s /bin/bash -D -S drone-scp
+	adduser -h /home/drone-scp -s /bin/sh -D -S drone-scp
 	echo drone-scp:1234 | chpasswd
 	mkdir -p /home/drone-scp/.ssh
 	chmod 700 /home/drone-scp/.ssh
 	cat tests/.ssh/id_rsa.pub >> /home/drone-scp/.ssh/authorized_keys
 	cat tests/.ssh/test.pub >> /home/drone-scp/.ssh/authorized_keys
+	chmod 600 /home/drone-scp/.ssh/authorized_keys
 	chown -R drone-scp /home/drone-scp/.ssh
 	# install ssh and start server
 	apk add --update openssh openrc
 	rm -rf /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_dsa_key
+	sed -i 's/^#PubkeyAuthentication yes/PubkeyAuthentication yes/g' /etc/ssh/sshd_config
 	sed -i 's/AllowTcpForwarding no/AllowTcpForwarding yes/g' /etc/ssh/sshd_config
 	./tests/entrypoint.sh /usr/sbin/sshd -D &
 

go.mod

@@ -1,10 +1,10 @@
 module github.com/appleboy/drone-ssh
 
-go 1.13
+go 1.14
 
 require (
-	github.com/appleboy/easyssh-proxy v1.3.0
+	github.com/appleboy/easyssh-proxy v1.3.6
 	github.com/joho/godotenv v1.3.0
-	github.com/stretchr/testify v1.4.0
+	github.com/stretchr/testify v1.3.0
-	github.com/urfave/cli v1.22.1
+	github.com/urfave/cli v1.22.4
 )

go.sum

@@ -1,8 +1,12 @@
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/ScaleFT/sshkeys v0.0.0-20181112160850-82451a803681 h1:JS2rl38kZmHgWa0xINSaSYH0Whtvem64/4+Ef0+Y5pE=
 github.com/ScaleFT/sshkeys v0.0.0-20181112160850-82451a803681/go.mod h1:WfDateMPQ/55dPbZRp5Zxrux5WiEaHsjk9puUhz0KgY=
-github.com/appleboy/easyssh-proxy v1.3.0 h1:ToH+hZDPWP9/9E58lwxDLJQSHvgGgDAQ9ZVx6x5oofI=
+github.com/appleboy/easyssh-proxy v1.3.4 h1:yNgzsJ9qaDNGzQILDXEK4boioJMmUUaTUsxYtCTSGqo=
-github.com/appleboy/easyssh-proxy v1.3.0/go.mod h1:Kk57I3w7OCafOjp5kgZFvxk2fO8Tca5CriBTOsbSbjY=
+github.com/appleboy/easyssh-proxy v1.3.4/go.mod h1:Kk57I3w7OCafOjp5kgZFvxk2fO8Tca5CriBTOsbSbjY=
+github.com/appleboy/easyssh-proxy v1.3.5 h1:EGTCbqAVRcGKHQMFSxz30lQmb+0nXL+jUiCrg/FjHQM=
+github.com/appleboy/easyssh-proxy v1.3.5/go.mod h1:Kk57I3w7OCafOjp5kgZFvxk2fO8Tca5CriBTOsbSbjY=
+github.com/appleboy/easyssh-proxy v1.3.6 h1:YELdI5z/NK/hSspkkcohSa9uJQxA4/e2H+f5jDD6pGA=
+github.com/appleboy/easyssh-proxy v1.3.6/go.mod h1:Kk57I3w7OCafOjp5kgZFvxk2fO8Tca5CriBTOsbSbjY=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
@@ -18,21 +22,17 @@ github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQD
 github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+github.com/urfave/cli v1.22.4 h1:u7tSpNPPswAFymm8IehJhy4uJMlUuU/GmqSkvJ1InXA=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/urfave/cli v1.22.4/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/urfave/cli v1.22.1 h1:+mkCCcOFKPnCmVYVcURKps1Xe+3zP90gSYGNfRkjoIY=
-github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191227163750-53104e6ec876 h1:sKJQZMuxjOAR/Uo2LBfU90onWEf1dF4C+0hPJCc9Mpc=
 golang.org/x/crypto v0.0.0-20191227163750-53104e6ec876/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a h1:1BGLXjeY4akVXGgbC9HugT3Jv3hCI0z56oJR5vAMgBU=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

main.go

@@ -19,7 +19,6 @@ func main() {
 	if filename, found := os.LookupEnv("PLUGIN_ENV_FILE"); found {
 		_ = godotenv.Load(filename)
 	}
-
 	app := cli.NewApp()
 	app.Name = "Drone SSH"
 	app.Usage = "Executing remote ssh commands"
@@ -40,7 +39,7 @@ func main() {
 		},
 		cli.StringFlag{
 			Name:   "ssh-passphrase",
-			Usage:  "ssh passphrase",
+			Usage:  "The purpose of the passphrase is usually to encrypt the private key.",
 			EnvVar: "PLUGIN_SSH_PASSPHRASE,PLUGIN_PASSPHRASE,SSH_PASSPHRASE,PASSPHRASE,INPUT_PASSPHRASE",
 		},
 		cli.StringFlag{
@@ -60,9 +59,25 @@ func main() {
 			EnvVar: "PLUGIN_PASSWORD,SSH_PASSWORD,PASSWORD,INPUT_PASSWORD",
 		},
 		cli.StringSliceFlag{
-			Name:   "host,H",
+			Name:   "ciphers",
-			Usage:  "connect to host",
+			Usage:  "The allowed cipher algorithms. If unspecified then a sensible",
-			EnvVar: "PLUGIN_HOST,SSH_HOST,HOST,INPUT_HOST",
+			EnvVar: "PLUGIN_CIPHERS,SSH_CIPHERS,CIPHERS,INPUT_CIPHERS",
+		},
+		cli.BoolFlag{
+			Name:   "useInsecureCipher",
+			Usage:  "include more ciphers with use_insecure_cipher",
+			EnvVar: "PLUGIN_USE_INSECURE_CIPHER,SSH_USE_INSECURE_CIPHER,USE_INSECURE_CIPHER,INPUT_USE_INSECURE_CIPHER",
+		},
+		cli.StringFlag{
+			Name:   "fingerprint",
+			Usage:  "fingerprint SHA256 of the host public key, default is to skip verification",
+			EnvVar: "PLUGIN_FINGERPRINT,SSH_FINGERPRINT,FINGERPRINT,INPUT_FINGERPRINT",
+		},
+		cli.StringSliceFlag{
+			Name:     "host,H",
+			Usage:    "connect to host",
+			EnvVar:   "PLUGIN_HOST,SSH_HOST,HOST,INPUT_HOST",
+			FilePath: ".host",
 		},
 		cli.IntFlag{
 			Name:   "port,p",
@@ -109,7 +124,7 @@ func main() {
 		},
 		cli.StringFlag{
 			Name:   "proxy.ssh-passphrase",
-			Usage:  "proxy ssh passphrase",
+			Usage:  "The purpose of the passphrase is usually to encrypt the private key.",
 			EnvVar: "PLUGIN_PROXY_SSH_PASSPHRASE,PLUGIN_PROXY_PASSPHRASE,PROXY_SSH_PASSPHRASE,PROXY_PASSPHRASE,INPUT_PROXY_PASSPHRASE",
 		},
 		cli.StringFlag{
@@ -144,6 +159,21 @@ func main() {
 			Usage:  "proxy connection timeout",
 			EnvVar: "PLUGIN_PROXY_TIMEOUT,PROXY_SSH_TIMEOUT,INPUT_PROXY_TIMEOUT",
 		},
+		cli.StringSliceFlag{
+			Name:   "proxy.ciphers",
+			Usage:  "The allowed cipher algorithms. If unspecified then a sensible",
+			EnvVar: "PLUGIN_PROXY_CIPHERS,SSH_PROXY_CIPHERS,PROXY_CIPHERS,INPUT_PROXY_CIPHERS",
+		},
+		cli.BoolFlag{
+			Name:   "proxy.useInsecureCipher",
+			Usage:  "include more ciphers with use_insecure_cipher",
+			EnvVar: "PLUGIN_PROXY_USE_INSECURE_CIPHER,SSH_PROXY_USE_INSECURE_CIPHER,PROXY_USE_INSECURE_CIPHER,INPUT_PROXY_USE_INSECURE_CIPHER",
+		},
+		cli.StringFlag{
+			Name:   "proxy.fingerprint",
+			Usage:  "fingerprint SHA256 of the host public key, default is to skip verification",
+			EnvVar: "PLUGIN_PROXY_FINGERPRINT,SSH_PROXY_FINGERPRINT,PROXY_FINGERPRINT,INPUT_PROXY_FINGERPRINT",
+		},
 		cli.StringSliceFlag{
 			Name:   "envs",
 			Usage:  "pass environment variable to shell script",
@@ -201,29 +231,35 @@ func run(c *cli.Context) error {
 	}
 	plugin := Plugin{
 		Config: Config{
-			Key:            c.String("ssh-key"),
+			Key:               c.String("ssh-key"),
-			KeyPath:        c.String("key-path"),
+			KeyPath:           c.String("key-path"),
-			Username:       c.String("user"),
+			Username:          c.String("user"),
-			Password:       c.String("password"),
+			Password:          c.String("password"),
-			Passphrase:     c.String("ssh-passphrase"),
+			Passphrase:        c.String("ssh-passphrase"),
-			Host:           c.StringSlice("host"),
+			Fingerprint:       c.String("fingerprint"),
-			Port:           c.Int("port"),
+			Host:              c.StringSlice("host"),
-			Timeout:        c.Duration("timeout"),
+			Port:              c.Int("port"),
-			CommandTimeout: c.Duration("command.timeout"),
+			Timeout:           c.Duration("timeout"),
-			Script:         scripts,
+			CommandTimeout:    c.Duration("command.timeout"),
-			ScriptStop:     c.Bool("script.stop"),
+			Script:            scripts,
-			Envs:           c.StringSlice("envs"),
+			ScriptStop:        c.Bool("script.stop"),
-			Debug:          c.Bool("debug"),
+			Envs:              c.StringSlice("envs"),
-			Sync:           c.Bool("sync"),
+			Debug:             c.Bool("debug"),
+			Sync:              c.Bool("sync"),
+			Ciphers:           c.StringSlice("ciphers"),
+			UseInsecureCipher: c.Bool("useInsecureCipher"),
 			Proxy: easyssh.DefaultConfig{
-				Key:        c.String("proxy.ssh-key"),
+				Key:               c.String("proxy.ssh-key"),
-				KeyPath:    c.String("proxy.key-path"),
+				KeyPath:           c.String("proxy.key-path"),
-				User:       c.String("proxy.username"),
+				User:              c.String("proxy.username"),
-				Password:   c.String("proxy.password"),
+				Password:          c.String("proxy.password"),
-				Passphrase: c.String("proxy.ssh-passphrase"),
+				Passphrase:        c.String("proxy.ssh-passphrase"),
-				Server:     c.String("proxy.host"),
+				Fingerprint:       c.String("proxy.fingerprint"),
-				Port:       c.String("proxy.port"),
+				Server:            c.String("proxy.host"),
-				Timeout:    c.Duration("proxy.timeout"),
+				Port:              c.String("proxy.port"),
+				Timeout:           c.Duration("proxy.timeout"),
+				Ciphers:           c.StringSlice("proxy.ciphers"),
+				UseInsecureCipher: c.Bool("proxy.useInsecureCipher"),
 			},
 		},
 		Writer: os.Stdout,

pipeline.libsonnet

@@ -9,7 +9,7 @@
     steps: [
       {
         name: 'vet',
-        image: 'golang:1.13',
+        image: 'golang:1.14',
         pull: 'always',
         commands: [
           'make vet',
@@ -23,7 +23,7 @@
       },
       {
         name: 'lint',
-        image: 'golang:1.13',
+        image: 'golang:1.14',
         pull: 'always',
         commands: [
           'make lint',
@@ -37,7 +37,7 @@
       },
       {
         name: 'misspell',
-        image: 'golang:1.13',
+        image: 'golang:1.14',
         pull: 'always',
         commands: [
           'make misspell-check',
@@ -51,7 +51,7 @@
       },
       {
         name: 'test',
-        image: 'golang:1.13-alpine',
+        image: 'golang:1.14-alpine',
         pull: 'always',
         commands: [
           'apk add git make curl perl bash build-base zlib-dev ucl-dev',
@@ -93,7 +93,7 @@
     steps: [
       {
         name: 'build-push',
-        image: 'golang:1.13',
+        image: 'golang:1.14',
         pull: 'always',
         environment: {
           CGO_ENABLED: '0',
@@ -109,7 +109,7 @@
       },
       {
         name: 'build-tag',
-        image: 'golang:1.13',
+        image: 'golang:1.14',
         pull: 'always',
         environment: {
           CGO_ENABLED: '0',
@@ -123,7 +123,7 @@
       },
       {
         name: 'executable',
-        image: 'golang:1.13',
+        image: 'golang:1.14',
         pull: 'always',
         commands: [
           './release/' + os + '/' + arch + '/' + name + ' --help',
@@ -188,7 +188,7 @@
     steps: [
       {
         name: 'build-all-binary',
-        image: 'golang:1.13',
+        image: 'golang:1.14',
         pull: 'always',
         commands: [
           'make release'

plugin.go

@@ -23,21 +23,24 @@ var (
 type (
 	// Config for the plugin.
 	Config struct {
-		Key            string
+		Key               string
-		Passphrase     string
+		Passphrase        string
-		KeyPath        string
+		KeyPath           string
-		Username       string
+		Username          string
-		Password       string
+		Password          string
-		Host           []string
+		Host              []string
-		Port           int
+		Port              int
-		Timeout        time.Duration
+		Fingerprint       string
-		CommandTimeout time.Duration
+		Timeout           time.Duration
-		Script         []string
+		CommandTimeout    time.Duration
-		ScriptStop     bool
+		Script            []string
-		Envs           []string
+		ScriptStop        bool
-		Proxy          easyssh.DefaultConfig
+		Envs              []string
-		Debug          bool
+		Proxy             easyssh.DefaultConfig
-		Sync           bool
+		Debug             bool
+		Sync              bool
+		Ciphers           []string
+		UseInsecureCipher bool
 	}
 
 	// Plugin structure
@@ -54,23 +57,29 @@ func escapeArg(arg string) string {
 func (p Plugin) exec(host string, wg *sync.WaitGroup, errChannel chan error) {
 	// Create MakeConfig instance with remote username, server address and path to private key.
 	ssh := &easyssh.MakeConfig{
-		Server:     host,
+		Server:            host,
-		User:       p.Config.Username,
+		User:              p.Config.Username,
-		Password:   p.Config.Password,
+		Password:          p.Config.Password,
-		Port:       strconv.Itoa(p.Config.Port),
+		Port:              strconv.Itoa(p.Config.Port),
-		Key:        p.Config.Key,
+		Key:               p.Config.Key,
-		KeyPath:    p.Config.KeyPath,
+		KeyPath:           p.Config.KeyPath,
-		Passphrase: p.Config.Passphrase,
+		Passphrase:        p.Config.Passphrase,
-		Timeout:    p.Config.Timeout,
+		Timeout:           p.Config.Timeout,
+		Ciphers:           p.Config.Ciphers,
+		Fingerprint:       p.Config.Fingerprint,
+		UseInsecureCipher: p.Config.UseInsecureCipher,
 		Proxy: easyssh.DefaultConfig{
-			Server:     p.Config.Proxy.Server,
+			Server:            p.Config.Proxy.Server,
-			User:       p.Config.Proxy.User,
+			User:              p.Config.Proxy.User,
-			Password:   p.Config.Proxy.Password,
+			Password:          p.Config.Proxy.Password,
-			Port:       p.Config.Proxy.Port,
+			Port:              p.Config.Proxy.Port,
-			Key:        p.Config.Proxy.Key,
+			Key:               p.Config.Proxy.Key,
-			KeyPath:    p.Config.Proxy.KeyPath,
+			KeyPath:           p.Config.Proxy.KeyPath,
-			Passphrase: p.Config.Proxy.Passphrase,
+			Passphrase:        p.Config.Proxy.Passphrase,
-			Timeout:    p.Config.Proxy.Timeout,
+			Timeout:           p.Config.Proxy.Timeout,
+			Ciphers:           p.Config.Proxy.Ciphers,
+			Fingerprint:       p.Config.Proxy.Fingerprint,
+			UseInsecureCipher: p.Config.Proxy.UseInsecureCipher,
 		},
 	}
 

plugin_test.go

@@ -3,6 +3,7 @@ package main
 import (
 	"bytes"
 	"io"
+	"io/ioutil"
 	"os"
 	"reflect"
 	"strings"
@@ -11,6 +12,7 @@ import (
 
 	"github.com/appleboy/easyssh-proxy"
 	"github.com/stretchr/testify/assert"
+	"golang.org/x/crypto/ssh"
 )
 
 func TestMissingHostOrUser(t *testing.T) {
@@ -384,6 +386,80 @@ func TestCommandOutput(t *testing.T) {
 	assert.Equal(t, unindent(expected), unindent(buffer.String()))
 }
 
+func TestWrongFingerprint(t *testing.T) {
+	var (
+		buffer bytes.Buffer
+	)
+
+	plugin := Plugin{
+		Config: Config{
+			Host:     []string{"localhost"},
+			Username: "drone-scp",
+			Port:     22,
+			KeyPath:  "./tests/.ssh/id_rsa",
+			Script: []string{
+				"whoami",
+			},
+			Fingerprint: "wrong",
+		},
+		Writer: &buffer,
+	}
+
+	err := plugin.Exec()
+	assert.NotNil(t, err)
+}
+
+func getHostPublicKeyFile(keypath string) (ssh.PublicKey, error) {
+	var pubkey ssh.PublicKey
+	var err error
+	buf, err := ioutil.ReadFile(keypath)
+	if err != nil {
+		return nil, err
+	}
+
+	pubkey, _, _, _, err = ssh.ParseAuthorizedKey(buf)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return pubkey, nil
+}
+
+func TestFingerprint(t *testing.T) {
+	var (
+		buffer   bytes.Buffer
+		expected = `
+			======CMD======
+			whoami
+			======END======
+			out: drone-scp
+		`
+	)
+
+	hostKey, err := getHostPublicKeyFile("/etc/ssh/ssh_host_rsa_key.pub")
+	assert.NoError(t, err)
+
+	plugin := Plugin{
+		Config: Config{
+			Host:     []string{"localhost"},
+			Username: "drone-scp",
+			Port:     22,
+			KeyPath:  "./tests/.ssh/id_rsa",
+			Script: []string{
+				"whoami",
+			},
+			Fingerprint:    ssh.FingerprintSHA256(hostKey),
+			CommandTimeout: 10 * time.Second,
+		},
+		Writer: &buffer,
+	}
+
+	err = plugin.Exec()
+	assert.Nil(t, err)
+	assert.Equal(t, unindent(expected), unindent(buffer.String()))
+}
+
 func TestScriptStop(t *testing.T) {
 	var (
 		buffer   bytes.Buffer
@@ -593,3 +669,38 @@ func TestPlugin_scriptCommands(t *testing.T) {
 		})
 	}
 }
+
+func TestUseInsecureCipher(t *testing.T) {
+	var (
+		buffer   bytes.Buffer
+		expected = `
+			======CMD======
+			mkdir a/b/c
+			mkdir d/e/f
+			======END======
+			err: mkdir: can't create directory 'a/b/c': No such file or directory
+			err: mkdir: can't create directory 'd/e/f': No such file or directory
+		`
+	)
+
+	plugin := Plugin{
+		Config: Config{
+			Host:     []string{"localhost"},
+			Username: "drone-scp",
+			Port:     22,
+			KeyPath:  "./tests/.ssh/id_rsa",
+			Script: []string{
+				"mkdir a/b/c",
+				"mkdir d/e/f",
+			},
+			CommandTimeout:    10 * time.Second,
+			UseInsecureCipher: true,
+		},
+		Writer: &buffer,
+	}
+
+	err := plugin.Exec()
+	assert.NotNil(t, err)
+
+	assert.Equal(t, unindent(expected), unindent(buffer.String()))
+}