CAMEL-24291: align host-key checking option metadata with camel-ftp and tidy SCP global/session redundancy

components/camel-jsch/src/main/java/org/apache/camel/component/scp/ScpComponent.java

@@ -75,7 +75,9 @@ public void setVerboseLogging(boolean verboseLogging) {
     }
 
     protected void initJsch() {
-        JSch.setConfig("StrictHostKeyChecking", "yes");
+        // StrictHostKeyChecking is applied per session from ScpConfiguration in ScpOperations.createSession();
+        // a global JSch.setConfig("StrictHostKeyChecking", ...) here would always be overridden by that per-session
+        // value, so it is intentionally not set to avoid a misleading (and contradictory) global default.
         JSch.setLogger(new Logger() {
             @Override
             public boolean isEnabled(int level) {

components/camel-jsch/src/main/java/org/apache/camel/component/scp/ScpConfiguration.java

@@ -56,7 +56,10 @@ public class ScpConfiguration extends RemoteFileConfiguration {
               description = "Set a comma separated list of CA signature algorithms accepted for host certificate verification."
                             + " If not specified the default list from JSch will be used (matches OpenSSH 8.2+ defaults).")
     private String caSignatureAlgorithms;
-    @UriParam(enums = "no,yes", defaultValue = "no")
+    @UriParam(label = "security", enums = "no,yes", defaultValue = "no", security = "insecure:ssl",
+              description = "Sets whether to use strict host key checking. Setting this to 'no' (the default) disables"
+                            + " host key verification and makes the connection vulnerable to man-in-the-middle attacks."
+                            + " Use 'yes' in production environments.")
     private String strictHostKeyChecking = "no";
     @UriParam(defaultValue = DEFAULT_MOD)
     private String chmod = DEFAULT_MOD;

components/camel-ssh/src/main/java/org/apache/camel/component/ssh/SshConfiguration.java

@@ -54,9 +54,13 @@ public class SshConfiguration implements Cloneable {
     private String certResourcePassword;
     @UriParam(defaultValue = "30000")
     private long timeout = 30000;
-    @UriParam()
+    @UriParam(label = "security", security = "insecure:ssl",
+              description = "Sets the resource path for a known_hosts file used to verify the SSH server host key."
+                            + " When not set, the client does not verify the server host key against a known_hosts file.")
     private String knownHostsResource;
-    @UriParam(defaultValue = "false")
+    @UriParam(label = "security", defaultValue = "false", security = "insecure:ssl", insecureValue = "false",
+              description = "Specifies whether a connection to an unknown SSH server host key should fail. When false,"
+                            + " host keys that are not present in the known_hosts resource are accepted.")
     private boolean failOnUnknownHost;
     @UriParam(label = "advanced", defaultValue = Channel.CHANNEL_EXEC)
     private String channelType = Channel.CHANNEL_EXEC;

core/camel-util/src/main/java/org/apache/camel/util/SecurityUtils.java

@@ -62,10 +62,12 @@ public record SecurityOption(String category, String insecureValue) {
         map.put("allowserializedheaders", new SecurityOption(INSECURE_SERIALIZATION, "true"));
         map.put("devconsoleenabled", new SecurityOption(INSECURE_DEV, "true"));
         map.put("downloadenabled", new SecurityOption(INSECURE_DEV, "true"));
+        map.put("failonunknownhost", new SecurityOption(INSECURE_SSL, VALUE_FALSE));
         map.put("hostnameverification", new SecurityOption(INSECURE_SSL, VALUE_FALSE));
         map.put("httpshostnameverificationenabled", new SecurityOption(INSECURE_SSL, VALUE_FALSE));
         map.put("ignoresslverification", new SecurityOption(INSECURE_SSL, "true"));
         map.put("ignoresslwarnings", new SecurityOption(INSECURE_SSL, "true"));
+        map.put("knownhostsresource", new SecurityOption(INSECURE_SSL, ""));
         map.put("objectmessageenabled", new SecurityOption(INSECURE_SERIALIZATION, "true"));
         map.put("sendenabled", new SecurityOption(INSECURE_DEV, "true"));
         map.put("skiptlsverify", new SecurityOption(INSECURE_SSL, "true"));

dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/SshComponentBuilderFactory.java

@@ -51,39 +51,6 @@ static SshComponentBuilder ssh() {
     interface SshComponentBuilder extends ComponentBuilder<SshComponent> {
 
 
-        /**
-         * Specifies whether a connection to an unknown host should fail or not.
-         * This value is only checked when the property knownHosts is set.
-         * 
-         * The option is a: &lt;code&gt;boolean&lt;/code&gt; type.
-         * 
-         * Default: false
-         * Group: common
-         * 
-         * @param failOnUnknownHost the value to set
-         * @return the dsl builder
-         */
-        default SshComponentBuilder failOnUnknownHost(boolean failOnUnknownHost) {
-            doSetProperty("failOnUnknownHost", failOnUnknownHost);
-            return this;
-        }
-
-        /**
-         * Sets the resource path for a known_hosts file.
-         * 
-         * The option is a: &lt;code&gt;java.lang.String&lt;/code&gt; type.
-         * 
-         * Group: common
-         * 
-         * @param knownHostsResource the value to set
-         * @return the dsl builder
-         */
-        default SshComponentBuilder knownHostsResource(java.lang.String knownHostsResource) {
-            doSetProperty("knownHostsResource", knownHostsResource);
-            return this;
-        }
-
-
         /**
          * Sets the timeout in milliseconds to wait in establishing the remote
          * SSH server connection. Defaults to 30000 milliseconds.
@@ -476,6 +443,25 @@ default SshComponentBuilder ciphers(java.lang.String ciphers) {
             return this;
         }
 
+
+        /**
+         * Specifies whether a connection to an unknown SSH server host key
+         * should fail. When false, host keys that are not present in the
+         * known_hosts resource are accepted.
+         * 
+         * The option is a: &lt;code&gt;boolean&lt;/code&gt; type.
+         * 
+         * Default: false
+         * Group: security
+         * 
+         * @param failOnUnknownHost the value to set
+         * @return the dsl builder
+         */
+        default SshComponentBuilder failOnUnknownHost(boolean failOnUnknownHost) {
+            doSetProperty("failOnUnknownHost", failOnUnknownHost);
+            return this;
+        }
+
         /**
          * Comma-separated list of allowed/supported key exchange algorithms in
          * their order of preference.
@@ -528,6 +514,23 @@ default SshComponentBuilder keyType(java.lang.String keyType) {
             return this;
         }
 
+        /**
+         * Sets the resource path for a known_hosts file used to verify the SSH
+         * server host key. When not set, the client does not verify the server
+         * host key against a known_hosts file.
+         * 
+         * The option is a: &lt;code&gt;java.lang.String&lt;/code&gt; type.
+         * 
+         * Group: security
+         * 
+         * @param knownHostsResource the value to set
+         * @return the dsl builder
+         */
+        default SshComponentBuilder knownHostsResource(java.lang.String knownHostsResource) {
+            doSetProperty("knownHostsResource", knownHostsResource);
+            return this;
+        }
+
         /**
          * Comma-separated list of allowed/supported message authentication code
          * algorithms in their order of preference. The MAC algorithm is used
@@ -612,8 +615,6 @@ protected boolean setPropertyOnComponent(
                 String name,
                 Object value) {
             switch (name) {
-            case "failOnUnknownHost": getOrCreateConfiguration((SshComponent) component).setFailOnUnknownHost((boolean) value); return true;
-            case "knownHostsResource": getOrCreateConfiguration((SshComponent) component).setKnownHostsResource((java.lang.String) value); return true;
             case "timeout": getOrCreateConfiguration((SshComponent) component).setTimeout((long) value); return true;
             case "bridgeErrorHandler": ((SshComponent) component).setBridgeErrorHandler((boolean) value); return true;
             case "pollCommand": getOrCreateConfiguration((SshComponent) component).setPollCommand((java.lang.String) value); return true;
@@ -636,9 +637,11 @@ protected boolean setPropertyOnComponent(
             case "certResource": getOrCreateConfiguration((SshComponent) component).setCertResource((java.lang.String) value); return true;
             case "certResourcePassword": getOrCreateConfiguration((SshComponent) component).setCertResourcePassword((java.lang.String) value); return true;
             case "ciphers": getOrCreateConfiguration((SshComponent) component).setCiphers((java.lang.String) value); return true;
+            case "failOnUnknownHost": getOrCreateConfiguration((SshComponent) component).setFailOnUnknownHost((boolean) value); return true;
             case "kex": getOrCreateConfiguration((SshComponent) component).setKex((java.lang.String) value); return true;
             case "keyPairProvider": getOrCreateConfiguration((SshComponent) component).setKeyPairProvider((org.apache.sshd.common.keyprovider.KeyPairProvider) value); return true;
             case "keyType": getOrCreateConfiguration((SshComponent) component).setKeyType((java.lang.String) value); return true;
+            case "knownHostsResource": getOrCreateConfiguration((SshComponent) component).setKnownHostsResource((java.lang.String) value); return true;
             case "macs": getOrCreateConfiguration((SshComponent) component).setMacs((java.lang.String) value); return true;
             case "password": getOrCreateConfiguration((SshComponent) component).setPassword((java.lang.String) value); return true;
             case "signatures": getOrCreateConfiguration((SshComponent) component).setSignatures((java.lang.String) value); return true;

dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/ScpEndpointBuilderFactory.java

@@ -260,22 +260,6 @@ default ScpEndpointBuilder flatten(String flatten) {
             doSetProperty("flatten", flatten);
             return this;
         }
-        /**
-         * Sets whether to use strict host key checking. Possible values are:
-         * no, yes.
-         * 
-         * The option is a: <code>java.lang.String</code> type.
-         * 
-         * Default: no
-         * Group: producer
-         * 
-         * @param strictHostKeyChecking the value to set
-         * @return the dsl builder
-         */
-        default ScpEndpointBuilder strictHostKeyChecking(String strictHostKeyChecking) {
-            doSetProperty("strictHostKeyChecking", strictHostKeyChecking);
-            return this;
-        }
         /**
          * Set a comma separated list of CA signature algorithms accepted for
          * host certificate verification. If not specified the default list from
@@ -469,6 +453,24 @@ default ScpEndpointBuilder privateKeyFilePassphrase(String privateKeyFilePassphr
             doSetProperty("privateKeyFilePassphrase", privateKeyFilePassphrase);
             return this;
         }
+        /**
+         * Sets whether to use strict host key checking. Setting this to 'no'
+         * (the default) disables host key verification and makes the connection
+         * vulnerable to man-in-the-middle attacks. Use 'yes' in production
+         * environments.
+         * 
+         * The option is a: <code>java.lang.String</code> type.
+         * 
+         * Default: no
+         * Group: security
+         * 
+         * @param strictHostKeyChecking the value to set
+         * @return the dsl builder
+         */
+        default ScpEndpointBuilder strictHostKeyChecking(String strictHostKeyChecking) {
+            doSetProperty("strictHostKeyChecking", strictHostKeyChecking);
+            return this;
+        }
         /**
          * Username to use for login.
          *