- unstable 2.7-1
|SSHFP(1)||Internet / DNS||SSHFP(1)|
NAME¶sshfp - Generate SSHFP DNS records from knownhosts files or ssh-keyscan
SYNTAX¶sshfp [-k <knownhosts_file>] [-d] [-a] [--type <algo>] [--digest <digest>] [<host1> [host2 ...]]
sshfp -s [-p <port>] [-d] [-a] [--type <algo>] [--digest <digest>] [-n <nameserver>] <domain1> [domain2] <host1> [host2 ...] >
DESCRIPTION¶sshfp generates RFC-4255 SSHFP DNS records based on the public keys stored in a known_hosts file, which implies the user has previously trusted this key, or public keys can be obtained by using ssh-keyscan (1). Using ssh-keyscan (1) implies a secure path to connect to the hosts being scanned. It also implies a trust in the DNS to obtain the IP address of the hostname to be scanned. If the nameserver of the domain allows zone tranfers (AXFR), an entire domain can be processed for all its A records.
OPTIONS¶-s / --scan <hostname1> [hostname2 ...]
-k / --knownhosts <knownhosts_file> <hostname1> [hostname2 ...]
-a / --all
-d / --trailing-dot
-o / --output <filename>
-p / --port <portnumber>
-h / --help
-v / --version
-q / --quiet
REQUIREMENTS¶sshfp requires python-dns (http://www.pythondns.org)
Fedora: yum install python-dns
Debian: apt-get install python-dnspython
BUGS¶if a domain contains non-working glue A records, then ssh-keyscan aborts instead of skipping the single broken entry.
This program can look up hashed hostnames in a known_hosts file if a recent-enough ssh-keygen is present
sshfp (implies -k -a)
sshfp -a -d (implies -k)
sshfp -k bofh.nohats.ca (from known_hosts)
sshfp -s bofh.nohats.ca (from a scan to the host)
sshfp -k ~paul/.ssh/known_hosts bofh.nohats.ca www.openswan.org -o /tmp/mysshfp.txt
sshfp -a -d -d nohats.ca -n ns0.nohats.ca >> /var/named/primary/nohats.ca
SEE ALSO¶ssh-keyscan(1) ssh(1) tlsa(1) and RFC-4255
AUTHORS¶Paul Wouters <email@example.com>, Jacob Appelbaum <firstname.lastname@example.org>, James Brown <email@example.com>
COPYRIGHT¶Copyright 2006-2010 Xelerance Corporation
Copyright 2012 Paul Wouters
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License (file COPYING in the distribution) for more details.
|January 2, 2015||Paul Wouters|