News for hackers. Stuff that matters.

A comment on Automatically populating .ssh/known_hosts.

Re:Automatically populating .ssh/known_hosts by mike-cardwell on Monday January 16, 2012 @08:47AM (#3470590)
Alternatively, stick "VerifyHostKeyDNS yes" in your OpenSSH client configuration, then add SSHFP DNS records to your domain, and configure up DNSSEC.

That way, OpenSSH will automate fingerprint verification by looking it up in the DNS.

If you have DNSSEC set up and you run the following command:

  ssh -o "VerifyHostKeyDNS yes" grepular.com
You'll notice that it doesn't ask you to verify the fingerprint.

  mike@alfa:~$ dig +short sshfp grepular.com
  2 1 D027033D70738EEF8F2D30ED4B0D507C99D35BB1
  1 1 4BDBAB48F0CE98D51FCA81AC7C915B00B20993BF
  mike@alfa:~$
[ Parent | on HN ]
Re:Automatically populating .ssh/known_hosts by cperciva on Monday January 16, 2012 @01:22PM (#3471770)
That works well for long-lived hosts, but it doesn't solve the VM problem, since you need to get the fingerprints into DNS in the first place.
[ Parent | on HN ]