Fix cleartext credential exposure in gNMI PAM auth (GHSA-fr8g-q48c-qpc4)

[marvellgit]

Replace ssh.InsecureIgnoreHostKey() with sshd host key pinning read from /mnt/host/etc/ssh/. Fail closed if keys cannot be loaded and bound a 5-second connect/handshake timeout to prevent rogue listener hangs.

Why I did it

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

• 202305
• 202311
• 202405
• 202411
• 202505
• 202511
• 202605

Tracking issue/work item for backport/cherry-pick request (GitHub issue or Microsoft ADO):
Failure type:

Tested branch

• master
• 202305
• 202311
• 202405
• 202411
• 202505
• 202511
• 202605
• N/A

Test result

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[qiluo-msft]

The fix is correct, but there are no unit tests for sshdHostKeyCallback or the new UserPwAuth logic. To make them testable without a running sshd, change sshAuthAddr from a const to a var (matching what was already done for sshHostKeyPaths):

// const sshAuthAddr = "127.0.0.1:22"
var sshAuthAddr = "127.0.0.1:22"

Then a pam_auth_test.go can cover all the key paths using an in-process SSH server on a random loopback port:

// sshdHostKeyCallback tests
TestCallback_AcceptsPinnedKey          // happy path
TestCallback_RejectsUnpinnedKey        // key mismatch returns error  
TestCallback_AcceptsAnyPinnedAmongMultiple  // multi-key pinning
TestCallback_SkipsMissingFiles         // partial missing → still ok
TestCallback_FailsClosedWithNoReadableFiles // all missing → error
TestCallback_FailsClosedWithInvalidContent  // bad PEM → error
TestCallback_FailsClosedWithTrailingData    // trailing bytes → error

// UserPwAuth tests (override sshHostKeyPaths + sshAuthAddr)
TestUserPwAuth_FailsClosedWhenNoHostKeys   // no key files → false, non-nil err
TestUserPwAuth_AcceptsValidCredentials     // correct password → true
TestUserPwAuth_RejectsWrongPassword        // wrong password → false
TestUserPwAuth_RejectsRogueListener        // server with different key → false

TestUserPwAuth_RejectsRogueListener is the most valuable: it spins up a local SSH server whose host key does not match the pinned one, asserts that UserPwAuth returns false/error without transmitting credentials — directly exercising the F020 attack scenario end-to-end.