View source for SSHFP

SSHFP records allow SSH host keys (see [http://tools.ietf.org/html/rfc4253 RFC 4253]) to be published via the [[DNS|Domain Name Service]]. An interesting benefit is that, should SSHFP lookup be the only allowed method of authenticating a host key, keys can be revoked by removing them from DNS. They are defined in [http://tools.ietf.org/html/rfc4255 RFC 4255]. It is resource record (RR) type 44 (0x2C).
<pre>       1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   algorithm   |    fp type    |                               /
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               /
       /                                                               /
       /                          fingerprint                          /
       /                                                               /
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</pre>

* Algorithm: 1 for RSA, 2 for DSS
* Fingerprint Type: 1 for SHA-1

SSHFP records can be looked up via <tt>dig -t sshfp</tt>:
<pre>[hoare](0) $ dig +short -t sshfp svn.research.sys
1 1 CC96EE17FF88BB18AC8994342AE2B24185BA1B26
[hoare](0) $</pre>

On [[FreeBSD]], the [http://www.freebsdports.info/ports/dns/sshfp.html dns/sshfp] port supplies [http://www.xelerance.com/software/sshfp/ sshfp]; [[Debian]] added the [http://packages.debian.org/sid/sshfp sshfp package] 2008-07-13. This tool generates SSHFP output from <tt>ssh-keyscan</tt> or KnownHosts files:
<pre>[prometheus](0) $ /usr/local/bin/sshfp ctapd03.research.sys
ctapd03.research.sys IN SSHFP 1 1 443e23a036005c581f4f3e2e5a7949091d7318cd
ctapd03.research.sys IN SSHFP 2 1 86b505f00cb65359f6e377758b92359fc6dbd49b
[prometheus](0) $ /usr/local/bin/sshfp
[207.59.224.206]:7710. IN SSHFP 2 1 9eee5ceda25f86d4d9bf7f8569e576c56b69b9fc
hoare.research.sys. IN SSHFP 1 1 cc96ee17ff88bb18ac8994342ae2b24185ba1b26
localhost IN SSHFP 1 1 46c7cec5dde1fa5647591fd8636087508defea91
providence.scur. IN SSHFP 1 1 cc96ee17ff88bb18ac8994342ae2b24185ba1b26
qemfd IN SSHFP 1 1 2626a74a1c42c15ad31da0ee187992606ce135e0
qemfd.net. IN SSHFP 1 1 2626a74a1c42c15ad31da0ee187992606ce135e0
svn.research.sys. IN SSHFP 1 1 cc96ee17ff88bb18ac8994342ae2b24185ba1b26
[prometheus](0) $ </pre>

== Use with [[OpenSSH]] ==
* Set <tt>"VerifyHostKeyDNS yes"</tt> in your SSH config file or on the command line with <tt>-OVerifyHostKeyDNS=yes</tt> to automatically trust hosts matching a secure fingerprint in DNS. Set it to "ask" to display the fingerprint, and apply the <tt>StrictHostKeyChecking</tt> -- this will be used for insecure fingerprints, even if <tt>VerifyHostKeyDNS</tt> has been set to "yes". With "no", SSHFP records will not be consulted.
* To extract an SSHFP fingerprint for keys in your KnownHosts file, use <tt>ssh-keygen -r HostNameAlias</tt>:
<pre>[recombinator](0) $ ssh-keygen -r qemfd.net
qemfd.net IN SSHFP 1 1 2626a74a1c42c15ad31da0ee187992606ce135e0
qemfd.net IN SSHFP 2 1 4193db02ecc3acd85f9abbaf71c8945ebe7f6067
[recombinator](0) $</pre>

== Use with djbdns ==
* Use the generic record format, '':fqdn:n:rdata:ttl:timestamp:lo'' (see http://cr.yp.to/djbdns/tinydns-data.html)
* Sample zone data file entry:
<pre>:qemfd.net:44:\001\001\046\046\247\112\034\102\301\132\323\035\240\356\030\171\222\140\154\341\065\340:</pre>
* The following perl script (courtesy of [mailto:henning@openbsd.org Henning Brauer]) will write a djbdns record for the RSA key at <tt>/etc/ssh/ssh_host_rsa_key.pub</tt> (it should be trivial to use <tt>ssh-keyscan</tt>, instead) to stdout (invoke with the desired FQDN as the single argument):
<pre>#!/usr/bin/perl

use strict;

open IN, "ssh-keygen -f /etc/ssh/ssh_host_rsa_key.pub -r $ARGV[0] |";
my $FP = <IN>;
close IN;
chop $FP;
my ($host, $in, $sshfp, $alg, $fptype, $fp) = split " ", $FP;
my $out = sprintf("\\%03o\\%03o", $alg, $fptype);
for (my $i = 0; $i < length($fp); $i += 2) {
	$out .= sprintf("\\%03o", hex substr($fp, $i, 2));
}
printf(":%s:44:%s:\n", $host, $out);</pre>
[[CATEGORY: Networking]]