Tech/Protocols/SSH
Use DNS SSHFP Resource Record
Confirming a host in normal SSH prompts the user if the host is unknown. Many users just accept the connection by typing "yes" and the host is saved in the known_hosts file. You can validate against DNS with SSHFP[1]_record which is fast and fun. You can read the RFC[2] also.
Modern versions of Linux OS require and option in the resolv.conf [3]
options edns0 trust-ad
Example Setup
To the bottom of the OpenSSH Client config at /etc/ssh/ssh_config add the following
VerifyHostKeyDNS yes
DNS Security is required and there can be issues and problems with how GLIBC works. You may need to add this to your /etc/resolvers.conf
options edns0 trust-ad
On the target host that you want to trust the hostkeys run
$ ssh-keygen -r lathama.net lathama.net IN SSHFP 1 1 d6e3140f7bd5bcc1818033f36d099e1d816e3028 lathama.net IN SSHFP 1 2 1b176aa089c687e522a8910537633ceb14ccffbc867941df327c480f0fa42e13 lathama.net IN SSHFP 3 1 a800d2366f21b4debb46cd5adc9d21c5ee18df2a lathama.net IN SSHFP 3 2 9b4cc3d674d39d694e9f6fd87f726674542cc2f9af58f9066e837476493dc689 lathama.net IN SSHFP 4 1 d0beecedb5eae665495320260360597267375f6c lathama.net IN SSHFP 4 2 020f5a2a45d8fd25ff52dbde87c0360437ed3c3a899c09fd319a6a3d9f9dddad
Add these records to DNS for the domain/host you wish to have SSH host keys trusted. Validate the DNS with dig.
$ dig +short lathama.net SSHFP 1 1 D6E3140F7BD5BCC1818033F36D099E1D816E3028 1 2 1B176AA089C687E522A8910537633CEB14CCFFBC867941DF327C480F 0FA42E13 3 1 A800D2366F21B4DEBB46CD5ADC9D21C5EE18DF2A 3 2 9B4CC3D674D39D694E9F6FD87F726674542CC2F9AF58F9066E837476 493DC689 4 1 D0BEECEDB5EAE665495320260360597267375F6C 4 2 020F5A2A45D8FD25FF52DBDE87C0360437ED3C3A899C09FD319A6A3D 9F9DDDAD
Then remove any existing trusts via the ssh-keygen tool.
$ ssh-keygen -R lathama.net
Everything should be working so now time to test.
$ ssh lathama.net "uptime" 17:04:51 up 6 days, 18:56, 1 user, load average: 0.00, 0.00, 0.00
To double check that try again.
$ ssh-keygen -R lathama.net Host lathama.net not found in /home/lathama/.ssh/known_hosts $ ssh lathama.net "uptime" 17:04:51 up 6 days, 18:56, 1 user, load average: 0.00, 0.00, 0.00
SSH Host Key Setup
Some times for systems like Nagios you need to just allow the hostkeys and not check them to get started fast. in /home/nagios/.ssh/config add
host * StrictHostKeyChecking no
Make sure the file is chmod 600 or maybe 640 would work.
Legacy Devices
An extreme example of enabling legacy algorithms and ciphers to log into a legacy device.
ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-dss -c aes256-cbc 192.168.15.252
Fingerprinting
In /etc/ssh/ssh_config you can configure the client to not ask for fingerprints which is the default. If you are often rebuilding systems then the fingerprint would not have the same value as with a long running system.
StrictHostKeyChecking no
Or on the CLI
ssh -o StrictHostKeyChecking=no targethostnamehere