3 ms·
You can put SSHFP records in the DNS. See "VerifyHostKeyDNS" in the SSH man page. You'll also want DNSSEC set up of course.
by mike-cardwell 13y ago
You can put SSHFP records in the DNS. See "VerifyHostKeyDNS" in the SSH man page. You'll also want DNSSEC set up of course.
- peterwwillis 13y agoAfter you get a validating stub resolver, since your OS probably doesn't ship with one by default.
- mike-cardwell 13y agoDoesn't take long to do an "apt-get install unbound" and then modify your network settings to use 127.0.0.1 as your resolver.
- rscale 13y agoAnd if you're using a DNS service that doesn't support SSHFP records, you can generate and distribute a base known_hosts file with your favorite configuration management solution.