118de8d7fSPeter AvalosHow to verify host keys using OpenSSH and DNS 218de8d7fSPeter Avalos--------------------------------------------- 318de8d7fSPeter Avalos 40cbfa66cSDaniel FojtOpenSSH contains support for verifying host keys using DNS as described 50cbfa66cSDaniel Fojtin https://tools.ietf.org/html/rfc4255. The document contains very brief 60cbfa66cSDaniel Fojtinstructions on how to use this feature. Configuring DNS is out of the 70cbfa66cSDaniel Fojtscope of this document. 818de8d7fSPeter Avalos 918de8d7fSPeter Avalos 1018de8d7fSPeter Avalos(1) Server: Generate and publish the DNS RR 1118de8d7fSPeter Avalos 1218de8d7fSPeter AvalosTo create a DNS resource record (RR) containing a fingerprint of the 1318de8d7fSPeter Avalospublic host key, use the following command: 1418de8d7fSPeter Avalos 1518de8d7fSPeter Avalos ssh-keygen -r hostname -f keyfile -g 1618de8d7fSPeter Avalos 1718de8d7fSPeter Avaloswhere "hostname" is your fully qualified hostname and "keyfile" is the 1818de8d7fSPeter Avalosfile containing the public host key file. If you have multiple keys, 1918de8d7fSPeter Avalosyou should generate one RR for each key. 2018de8d7fSPeter Avalos 2118de8d7fSPeter AvalosIn the example above, ssh-keygen will print the fingerprint in a 2218de8d7fSPeter Avalosgeneric DNS RR format parsable by most modern name server 2318de8d7fSPeter Avalosimplementations. If your nameserver has support for the SSHFP RR 2418de8d7fSPeter Avalosyou can omit the -g flag and ssh-keygen will print a standard SSHFP RR. 2518de8d7fSPeter Avalos 2618de8d7fSPeter AvalosTo publish the fingerprint using the DNS you must add the generated RR 2718de8d7fSPeter Avalosto your DNS zone file and sign your zone. 2818de8d7fSPeter Avalos 2918de8d7fSPeter Avalos 3018de8d7fSPeter Avalos(2) Client: Enable ssh to verify host keys using DNS 3118de8d7fSPeter Avalos 3218de8d7fSPeter AvalosTo enable the ssh client to verify host keys using DNS, you have to 3318de8d7fSPeter Avalosadd the following option to the ssh configuration file 3418de8d7fSPeter Avalos($HOME/.ssh/config or /etc/ssh/ssh_config): 3518de8d7fSPeter Avalos 3618de8d7fSPeter Avalos VerifyHostKeyDNS yes 3718de8d7fSPeter Avalos 3818de8d7fSPeter AvalosUpon connection the client will try to look up the fingerprint RR 3918de8d7fSPeter Avalosusing DNS. If the fingerprint received from the DNS server matches 4018de8d7fSPeter Avalosthe remote host key, the user will be notified. 4118de8d7fSPeter Avalos 4218de8d7fSPeter Avalos 4318de8d7fSPeter Avalos Jakob Schlyter 4418de8d7fSPeter Avalos Wesley Griffin 4518de8d7fSPeter Avalos 4618de8d7fSPeter Avalos 4718de8d7fSPeter Avalos$OpenBSD: README.dns,v 1.2 2003/10/14 19:43:23 jakob Exp $ 48