38a52bd3b5
Release notes are available at https://www.openssh.com/txt/release-9.1 9.1 contains fixes for three minor memory safety problems; these have lready been merged to the copy of OpenSSH 9.0 that is in the FreeBSD base system. Some highlights copied from the release notes: Potentially-incompatible changes -------------------------------- * ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used. bz3438 * ssh-keygen(8): ssh-keygen -A (generate all default host key types) will no longer generate DSA keys, as these are insecure and have not been used by default for some years. New features ------------ * ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum RSA key length. Keys below this length will be ignored for user authentication and for host authentication in sshd(8). * sftp-server(8): add a "users-groups-by-id@openssh.com" extension request that allows the client to obtain user/group names that correspond to a set of uids/gids. * sftp(1): use "users-groups-by-id@openssh.com" sftp-server extension (when available) to fill in user/group names for directory listings. * sftp-server(8): support the "home-directory" extension request defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps a bit with the existing "expand-path@openssh.com", but some other clients support it. * ssh-keygen(1), sshd(8): allow certificate validity intervals, sshsig verification times and authorized_keys expiry-time options to accept dates in the UTC time zone in addition to the default of interpreting them in the system time zone. YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed with a 'Z' character. Also allow certificate validity intervals to be specified in raw seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This is intended for use by regress tests and other tools that call ssh-keygen as part of a CA workflow. bz3468 * sftp(1): allow arguments to the sftp -D option, e.g. sftp -D "/usr/libexec/sftp-server -el debug3" * ssh-keygen(1): allow the existing -U (use agent) flag to work with "-Y sign" operations, where it will be interpreted to require that the private keys is hosted in an agent; bz3429 MFC after: 2 weeks Relnotes: Yes Sponsored by: The FreeBSD Foundation
163 lines
3.9 KiB
Groff
163 lines
3.9 KiB
Groff
.\" $OpenBSD: ssh-keyscan.1,v 1.46 2022/06/03 04:00:15 dtucker Exp $
|
|
.\"
|
|
.\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
|
|
.\"
|
|
.\" Modification and redistribution in source and binary forms is
|
|
.\" permitted provided that due credit is given to the author and the
|
|
.\" OpenBSD project by leaving this copyright notice intact.
|
|
.\"
|
|
.Dd $Mdocdate: June 3 2022 $
|
|
.Dt SSH-KEYSCAN 1
|
|
.Os
|
|
.Sh NAME
|
|
.Nm ssh-keyscan
|
|
.Nd gather SSH public keys from servers
|
|
.Sh SYNOPSIS
|
|
.Nm ssh-keyscan
|
|
.Op Fl 46cDHv
|
|
.Op Fl f Ar file
|
|
.Op Fl p Ar port
|
|
.Op Fl T Ar timeout
|
|
.Op Fl t Ar type
|
|
.Op Ar host | addrlist namelist
|
|
.Sh DESCRIPTION
|
|
.Nm
|
|
is a utility for gathering the public SSH host keys of a number of
|
|
hosts.
|
|
It was designed to aid in building and verifying
|
|
.Pa ssh_known_hosts
|
|
files,
|
|
the format of which is documented in
|
|
.Xr sshd 8 .
|
|
.Nm
|
|
provides a minimal interface suitable for use by shell and perl
|
|
scripts.
|
|
.Pp
|
|
.Nm
|
|
uses non-blocking socket I/O to contact as many hosts as possible in
|
|
parallel, so it is very efficient.
|
|
The keys from a domain of 1,000
|
|
hosts can be collected in tens of seconds, even when some of those
|
|
hosts are down or do not run
|
|
.Xr sshd 8 .
|
|
For scanning, one does not need
|
|
login access to the machines that are being scanned, nor does the
|
|
scanning process involve any encryption.
|
|
.Pp
|
|
The options are as follows:
|
|
.Bl -tag -width Ds
|
|
.It Fl 4
|
|
Force
|
|
.Nm
|
|
to use IPv4 addresses only.
|
|
.It Fl 6
|
|
Force
|
|
.Nm
|
|
to use IPv6 addresses only.
|
|
.It Fl c
|
|
Request certificates from target hosts instead of plain keys.
|
|
.It Fl D
|
|
Print keys found as SSHFP DNS records.
|
|
The default is to print keys in a format usable as a
|
|
.Xr ssh 1
|
|
.Pa known_hosts
|
|
file.
|
|
.It Fl f Ar file
|
|
Read hosts or
|
|
.Dq addrlist namelist
|
|
pairs from
|
|
.Ar file ,
|
|
one per line.
|
|
If
|
|
.Sq -
|
|
is supplied instead of a filename,
|
|
.Nm
|
|
will read from the standard input.
|
|
Input is expected in the format:
|
|
.Bd -literal
|
|
1.2.3.4,1.2.4.4 name.my.domain,name,n.my.domain,n,1.2.3.4,1.2.4.4
|
|
.Ed
|
|
.It Fl H
|
|
Hash all hostnames and addresses in the output.
|
|
Hashed names may be used normally by
|
|
.Xr ssh 1
|
|
and
|
|
.Xr sshd 8 ,
|
|
but they do not reveal identifying information should the file's contents
|
|
be disclosed.
|
|
.It Fl p Ar port
|
|
Connect to
|
|
.Ar port
|
|
on the remote host.
|
|
.It Fl T Ar timeout
|
|
Set the timeout for connection attempts.
|
|
If
|
|
.Ar timeout
|
|
seconds have elapsed since a connection was initiated to a host or since the
|
|
last time anything was read from that host, the connection is
|
|
closed and the host in question considered unavailable.
|
|
The default is 5 seconds.
|
|
.It Fl t Ar type
|
|
Specify the type of the key to fetch from the scanned hosts.
|
|
The possible values are
|
|
.Dq dsa ,
|
|
.Dq ecdsa ,
|
|
.Dq ed25519 ,
|
|
.Dq ecdsa-sk ,
|
|
.Dq ed25519-sk ,
|
|
or
|
|
.Dq rsa .
|
|
Multiple values may be specified by separating them with commas.
|
|
The default is to fetch
|
|
.Dq rsa ,
|
|
.Dq ecdsa ,
|
|
.Dq ed25519 ,
|
|
.Dq ecdsa-sk ,
|
|
and
|
|
.Dq ed25519-sk
|
|
keys.
|
|
.It Fl v
|
|
Verbose mode:
|
|
print debugging messages about progress.
|
|
.El
|
|
.Pp
|
|
If an ssh_known_hosts file is constructed using
|
|
.Nm
|
|
without verifying the keys, users will be vulnerable to
|
|
.Em man in the middle
|
|
attacks.
|
|
On the other hand, if the security model allows such a risk,
|
|
.Nm
|
|
can help in the detection of tampered keyfiles or man in the middle
|
|
attacks which have begun after the ssh_known_hosts file was created.
|
|
.Sh FILES
|
|
.Pa /etc/ssh/ssh_known_hosts
|
|
.Sh EXAMPLES
|
|
Print the RSA host key for machine
|
|
.Ar hostname :
|
|
.Pp
|
|
.Dl $ ssh-keyscan -t rsa hostname
|
|
.Pp
|
|
Find all hosts from the file
|
|
.Pa ssh_hosts
|
|
which have new or different keys from those in the sorted file
|
|
.Pa ssh_known_hosts :
|
|
.Bd -literal -offset indent
|
|
$ ssh-keyscan -t rsa,dsa,ecdsa,ed25519 -f ssh_hosts | \e
|
|
sort -u - ssh_known_hosts | diff ssh_known_hosts -
|
|
.Ed
|
|
.Sh SEE ALSO
|
|
.Xr ssh 1 ,
|
|
.Xr sshd 8
|
|
.Rs
|
|
.%D 2006
|
|
.%R RFC 4255
|
|
.%T Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints
|
|
.Re
|
|
.Sh AUTHORS
|
|
.An -nosplit
|
|
.An David Mazieres Aq Mt dm@lcs.mit.edu
|
|
wrote the initial version, and
|
|
.An Wayne Davison Aq Mt wayned@users.sourceforge.net
|
|
added support for protocol version 2.
|