3 ms·
Alternatively, stick "VerifyHostKeyDNS yes" in your OpenSSH client configuration, then add SSHFP DNS records to your domain, and configure up DNSSEC. That way,
by mike-cardwell 15y ago
Alternatively, stick "VerifyHostKeyDNS yes" in your OpenSSH client configuration, then add SSHFP DNS records to your domain, and configure up DNSSEC.
That way, OpenSSH will automate fingerprint verification by looking it up in the DNS.
If you have DNSSEC set up and you run the following command:
ssh -o "VerifyHostKeyDNS yes" grepular.com
You'll notice that it doesn't ask you to verify the fingerprint.
mike@alfa:~$ dig +short sshfp grepular.com
2 1 D027033D70738EEF8F2D30ED4B0D507C99D35BB1
1 1 4BDBAB48F0CE98D51FCA81AC7C915B00B20993BF
mike@alfa:~$
- cperciva 15y agoThat works well for long-lived hosts, but it doesn't solve the VM problem, since you need to get the fingerprints into DNS in the first place.