Context
Change Type: Improvement
Product area: Device management & connectivity
Component: Cloud Remote Access
Deployed at: eu.latest.cumulocity.com
Technical details
Build artifact: cloud-remote-access (3.3.0)
Internal ID: DM-6421
Description
The handling of the SSH server host key for Cloud Remote Access endpoints is now controlled by the hostkey-autosave tenant option in the remoteaccess category. The option defaults to false, so the server host key must be confirmed on first connect. This is a deliberate security change from the previous silent-autosave behavior.
When hostkey-autosave is false (the default), connecting to an endpoint that has no host key stored yet first probes the server and shows its host key fingerprint, and the connection continues only after you confirm it. When set to true, the server host key is instead trusted and saved automatically on the first successful connection. In both cases, the stored host key is verified on every subsequent connection, and a mismatch aborts the connection.