Over a year ago, I raised an issue about the External SSH Tool node and the way it handles key-based authentication. The response from the KNIME team was that an enhancement ticket had been opened. Several versions later, there is no change to the way this node works, even in 5.x.
The problem with this node is getting worse - The desktop preferences for General, Network Connections, SSH2 only seems to allow DSA (ssh-dss) and RSA with SHA1 (ssh-rsa) key types. BOTH of which have been officially deprecated by the OpenSSH project because of algorithmic weaknesses. If you specify an rsa-sha2-512 (the current default rsa keytype generated by ssh-keygen) or ecdsa keyfile in the private key list in SSH2 network preferences, PublicKey auth will not function using the External SSH Tool. The lack of support for current SSH standards is almost becoming comical at this point, if it weren’t such a security risk.
The SSH Connector node functions properly, but it does not allow for remote command execution, only SFTP/filesystem operations. Remote command execution is a key workflow use case. As of now, I can use an ecdsa key with the SSH Connector node, but External SSH Tool refuses to recognize the exact same key when configured through preferences.
Either the External SSH Tool node needs to be re-written to use the same config semantics as the SSH Connector (auth keyfile is specific to the node), or the SSH2 network connection framework needs to be updated to support current secure key types. This is long past due. When is someone going to take this seriously instead of forcing users to kludge around it and re-activate insecure mechanisms at the sshd level?