Re: commandline download...
Hi,
...
* 2007-11-21 18:49:12.875 Host key wasn't verified!
. 2007-11-21 18:49:12.875 Closing connection.
...
because i allways trust my servers.
so, what could i do to get this working?
Make a list of host keys for all of your servers, and add those host keys to WinSCP -- either through the use of an INI file, or via a registry file that you (silently?) import before firing off the WinSCP script.
I think Martin has said before, it's a gross security risk (read: Bad Idea[tm]) to blindly accept a host key without verification. That's putting all your trust in the infallibility of the network to prevent a MitM attack. In most cases the network is NOT cryptographically strong, and so it reduces the security of your ssh (weakest link, etc). If you really care so little about the security of your file transfer, plaintext FTP requires no host key caching and because it has no cryptographic overhead, may even be faster. The fact that you're sending your user account credentials in plain text is, in our hypothetical scenario, a non-issue. Or even better, use TFTP and dispense with the facade of user authentication altogether. Realize that any of these options are equivalent from a security standpoint. (Well, okay plain FTP might be worse because the user credentials revealed could potentially be used to impersonate that user elsewhere.)