Security with Go

Verifying remote host

To verify the remote host, in ssh.ClientConfig, set HostKeyCallback to ssh.FixedHostKey() and pass it the public key of the remote host. If you attempt to connect to the server and it provides a different public key, the connection will be aborted. This is important for ensuring that you are connecting to the expected server and not a malicious server. If DNS is compromised, or an attacker performs a successful ARP spoof, it's possible that your connection will be redirected or will be a victim of the man-in-the-middle attack, but an attacker will not be able to imitate the real server without the corresponding private key for the server. For testing purposes, you may choose to ignore the key provided by the remote host. ...