README.dns revision 126274
1278320SjhbHow to verify host keys using OpenSSH and DNS 2278320Sjhb--------------------------------------------- 3278320Sjhb 4278320SjhbOpenSSH contains support for verifying host keys using DNS as described in 5278320Sjhbdraft-ietf-secsh-dns-05.txt. The document contains very brief instructions 6278320Sjhbon how to use this feature. Configuring DNS is out of the scope of this 7278320Sjhbdocument. 8278320Sjhb 9278320Sjhb 10278320Sjhb(1) Server: Generate and publish the DNS RR 11278320Sjhb 12278320SjhbTo create a DNS resource record (RR) containing a fingerprint of the 13278320Sjhbpublic host key, use the following command: 14278320Sjhb 15278320Sjhb ssh-keygen -r hostname -f keyfile -g 16278320Sjhb 17278320Sjhbwhere "hostname" is your fully qualified hostname and "keyfile" is the 18278320Sjhbfile containing the public host key file. If you have multiple keys, 19278320Sjhbyou should generate one RR for each key. 20278320Sjhb 21278320SjhbIn the example above, ssh-keygen will print the fingerprint in a 22278320Sjhbgeneric DNS RR format parsable by most modern name server 23278320Sjhbimplementations. If your nameserver has support for the SSHFP RR 24278320Sjhbyou can omit the -g flag and ssh-keygen will print a standard SSHFP RR. 25278320Sjhb 26278320SjhbTo publish the fingerprint using the DNS you must add the generated RR 27278320Sjhbto your DNS zone file and sign your zone. 28278320Sjhb 29278320Sjhb 30278320Sjhb(2) Client: Enable ssh to verify host keys using DNS 31278320Sjhb 32278320SjhbTo enable the ssh client to verify host keys using DNS, you have to 33278320Sjhbadd the following option to the ssh configuration file 34278320Sjhb($HOME/.ssh/config or /etc/ssh/ssh_config): 35278320Sjhb 36278320Sjhb VerifyHostKeyDNS yes 37278320Sjhb 38278320SjhbUpon connection the client will try to look up the fingerprint RR 39306533Sjhbusing DNS. If the fingerprint received from the DNS server matches 40278320Sjhbthe remote host key, the user will be notified. 41278320Sjhb 42 43 Jakob Schlyter 44 Wesley Griffin 45 46 47$OpenBSD: README.dns,v 1.2 2003/10/14 19:43:23 jakob Exp $ 48