MAN page from RedHat Other ssh-extras-1.2.25-1us.libc5.i386.rpm

MAKE-SSH-KNOWN-HOSTS

Section: User Commands (1)
Updated: November 8, 1995
Index

NAME

make-ssh-known-hosts - make ssh_known_hosts file from DNS data

SYNOPSIS

make-ssh-known-hosts: [--initialdns initial_dns]
[--server domain_name_server]
[--subdomains comma_separated_list_of_subdomains]
[--debug debug_level]
[--timeout ssh_exec_timeout]
[--pingtimeout ping_timeout]
[--passwordtimeout timeout_when_asking_password]
[--notrustdaemon]
[--norecursive]
[--domainnamesplit]
[--silent]
[--keyscan]
[--nslookup path_to_nslookup_program]
[--ssh path_to_ssh_program]
domain_name [take_regexp [remove_regexp]]

DESCRIPTION

make-ssh-known-hostsis a perl5 script that helps create the/etc/ssh/ssh_known_hostsfile, which is used bysshto contain the host keys of all publicly known hosts. Sshdoes not normally permit login using rhosts or /etc/hosts.equivauthentication unless the server knows the client's host key. Inaddition, the host keys are used to prevent man-in-the-middle attacks.

In addition to/etc/ssh/ssh_known_hosts,sshalso uses the$HOME/.ssh/known_hostsfile. This file, however, is intended to contain only those hoststhat the particular user needs but are not in the global file. It isintended that the/etc/ssh/ssh_known_hostsfile be maintained by the system administration, and periodicallyupdated to contain the host keys for any new hosts.

Themake-ssh-known-hostsprogram finds all the hosts in a domain by making a DNS query to themaster domain name server of the domain. The master domain name serveris located by searching for the SOA record of the domain from the initialdomain name server (which can be specified with the--initialdnsoption). The master domain name server can also be given directly withthe--serveroption.

After getting the hostname listmake-ssh-known-hoststries to get the public key from every host in the domain. It firsttries to connect ssh port to check check if the host is alive, and ifso, it tries to run the commandcat /etc/ssh/ssh_host_key.pubon the remote machine usingssh.If the command succeeds, it knows the remote machine hassshinstalled properly, and it then extracts the public key from theoutput, and prints the/etc/ssh/ssh_known_hostsentry for it to STDOUT. Becausemake-ssh-known-hostsis usually run beforeremote machines have /etc/ssh/ssh_known_hosts file you may have to useRSA-authentication to allow access to hosts.

If the command fails for some reason, it checks if thesshclient still got the public key from the remote host in the initial dialog,and if so, it will print a proper entry, and if--notrustdaemonoption is given comment it out.

Domain_nameis the domain name for which the file is to be generated. By default make-ssh-known-hostsextracts also all subdomains of domain. Many sites will want toinclude several domains in their/etc/ssh/ssh_known_hostsfile. The entries for each domain should be extracted separately byrunningmake-ssh-known-hostsonce for each domain. The results should then be combined to createthe final file.

Take_regexpis a perl regular expression that matches the hosts to be taken from thedomain. The data matched contains all the DNS records in the form "fieldname=value". The fields are separated with newline, and the perl match is made inmultiline mode and it is case insensetive. The multiline mode meansthat you can use a regexp like "^wks=.*telnet.*$" to match all hosts that have WKS (well known services) field thatcontains value "telnet".

Remove_regexpis similar but those hosts that match the regexp are not added (it canbe used for example to filter out PCs and Macs using the hinfo field: "^hinfo=.*(mac|pc)").

OPTIONS

--initialdns initial_dns
-i initial_dns: Set the initial domain name server used to query the SOA record of thedomain.
--server domain_name_server
-se domain_name_server: Set the master domain name server of the domain. This host is usedto query the DNS list of the domain.
--subdomains subdomainlist
-su subdomainlist: Comma separated list of subdomains that are added to hostnames. Forexample, if subdomainlist is ",foo, foo.bar, foo.bar.zappa, foo.bar.zappa.hut.fi" then when host foobar is added to/etc/ssh/ssh_known_hostsfile it has aliases "foobar, foobar.foo, foobar.foo.bar, foobar.foo.bar.zappa, foobar.foo.bar.zappa.hut.fi". The default action is to take all subparts of the host but thesecond last on a host by host basis. (The last element is usually thecountry code, and something like foobar.foo.bar.zappa.hut would not make sense.)
--debug debug_level
-de debug_level: Set the debug level. Default is 5, bigger values give more output.Using a big value (like 999) will print lots of debugging output.
--timeout ssh_exec_timeout
-ti ssh_exec_timeout: Timeout when executingsshcommand. The default is 60 seconds.
--pingtimeout ping_timeout
-pi ping_timeout: Timeout when trying to ping the ssh port. The default is 3 seconds.
--passwordtimeout timeout_when_asking_password
-pa timeout_when_asking_password: Timeout when asking password for ssh command. Default is that nopasswords are queried. Use value 0 to have no timeout for password queries.
--notrustdaemon
-notr: If thesshcommand fails, use the public key stored in the local known hosts fileand trust it is the correct key for the host. If this option is notgiven such entries are commented out in the generated/etc/ssh/ssh_known_hostsfile.
--norecursive
-nor: Tellmake-ssh-known-hoststhat it should only extract keys for the given domain, and not to berecursive.
--domainnamesplit
-do: Split the domainname to get the list of subdomains. Use this optionif you don't want hostname to splitted to pieces automatically.Default splitting is done host by host basis. If the domain iszappa.hut.fi, and the host name is foo.bar then default action addsentries "foo, foo.bar, foo.bar.zappa, foo.bar.zappa.hut.fi" and this options adds entries "foo.bar, foo.bar.zappa, foo.bar.zappa.hut.fi").
--silent
-si: Be silent.
--keyscan
-k: Output list of all hosts in format "ipaddr1,ipaddr2,...ipaddrnhostname.domain.co,hostname,ipaddr1,ipaddr2,all_other_hostname_entries".The output of this can be feeded to ssh-keyscan to fetch keys.
--nslookup path_to_nslookup_program
-n path_to_nslookup_program: Path to thenslookupprogram.
--ssh path_to_ssh_program
-ss path_to_ssh_program: Path to thesshprogram, including all options.

EXAMPLES

The following command:

: example# make-ssh-known-hosts cs.hut.fi > /etc/ssh/ssh_known_hosts

finds all public keys of the hosts incs.hut.fidomain and put them to/etc/ssh/ssh_known_hostsfile splitting domain names on a per host basis.

The command

: example% make-ssh-known-hosts hut.fi '^wks=.*ssh' > hut-hosts

finds all hosts inhut.fidomain, and its subdomains having own name server (cs.hut.fi,tf.hut.fi, tky.hut.fi) that have ssh service and puts their public keyto hut-hosts file. This would require that the domain name server ofhut.fi would define all hosts running ssh to have entry ssh in theirWKS record. Because nobody yet adds ssh to WKS, it would be better touse command

: example% make-ssh-known-hosts hut.fi '^wks=.*telnet' > hut-hosts

that would take those host having telnet service. This uses defaultsubdomain list.

The command:

: example% make-ssh-known-hosts hut.fi 'dipoli.hut.fi' '^hinfo=.*(mac|pc)' > dipoli-hosts

finds all hosts in hut.fi domain that are in dipoli.hut.fi subdomain(note dipoli.hut.fi does not have own name server so its entries arein hut.fi-server) and that are not Mac or PC.

FILES

/etc/ssh/ssh_known_hosts Global host public key list

AUTHOR

Tero Kivinen <kivinenAATThut.fi>

COPYING

Permission is granted to make and distribute verbatim copies ofthis manual provided the copyright notice and this permission noticeare preserved on all copies.

Permission is granted to copy and distribute modified versions of thismanual under the conditions for verbatim copying, provided that theentire resulting derived work is distributed under the terms of apermission notice identical to this one.

Permission is granted to copy and distribute translations of thismanual into another language, under the above conditions for modifiedversions, except that this permission notice may be included intranslations approved by the the author instead of in the originalEnglish.

This document was created byman2html,using the manual pages.