SSHFP(1)

🦋 SSHFP(1) — the sshfp girlies' guide 🦋

okay bestie, welcome to sshfp(1) from the Internet / DNS section of the manual. she generates SSHFP DNS records and she EATS. let's go 💅

---

✨ NAME ✨

sshfp — generate SSHFP DNS records from knownhosts files or ssh-keyscan 🌸

---

✨ SYNTAX ✨

sshfp [-k <knownhosts_file>] [-d] [-a] [-t <algo>] [--digest <digest>]
[<host1> [<host2> ...]]

sshfp -s [-p <port>] [-d] [-a] [-t <algo>] [--digest <digest>] [-n
<nameserver>] <domain1> [domain2] <host1> [host2 ...]

two whole modes, two whole vibes, pick your fighter 💖

---

✨ DESCRIPTION ✨

so basically, sshfp generates RFC-4255 SSHFP DNS records. and it gets those records from one of two places:

• the public keys chillin' in a known_hosts file — which lowkey means the user already trusted that key at some point 👑
• public keys grabbed by using ssh-keyscan(1) 🦋

real talk though: using ssh-keyscan(1) implies a secure path to connect to the hosts you're scanning. it also implies trust in the DNS to get the IP address of the hostname you're scanning. that's two whole trust assumptions, bestie, not one.

and if the nameserver of the domain allows zone transfers (AXFR)? then an entire domain can be processed for all its A records. the whole thing. slay. ✨

---

✨ OPTIONS ✨

• -s, --scan <hostname1> [hostname2 ...] — scan a host or a whole domain for public SSH keys using ssh-keyscan. go get 'em 🔥
• -k, --knownhosts <knownhosts_file> <hostname1> [hostname2 ...] — grab public SSH keys out of a known_hosts file. defaults to using ~/.ssh/known_hosts 💖
• -a, --all — when you use it with -k, it scans all the hosts in the known_hosts file. when you use it with -s, it will attempt a zone transfer (AXFR) to obtain all A records in the domain you specified. all of them. the entire buffet 🍓
• -d, --trailing-dot — adds a trailing dot to the hostname in the SSHFP records. and here's the whole tea, bestie, because it's genuinely a lot: it is not possible to determine whether a known_hosts or DNS query is for a FQDN (eg www.redhat.com) or not (eg www) or not (unless -d domainname -a is used, in which case a trailing dot is always appended). non-FQDN get their domainname appended through /etc/resolv.conf. these non-FQDN will happen when using a non-FQDN (eg sshfp -k www) or known_hosts entries obtained by running ssh www.sub where .domain.com is implied. when -d is used, all hostnames not ending with a dot, that at least contain two parts in their hostname (eg www.sub but not www) get a trailing dot. and note that the output of sshfp can also just be manually edited for trailing dots. DIY icon behaviour 💅
• --digest <digest> — fingerprint hash function. may be specified more than once. default sha1,sha256 🌈
• -n, --nameserver <nameserver> — nameserver to use for AXFR (only valid with -s -a) ⭐
• -o, --output <filename> — write to filename instead of stdout 🎀
• -p, --port <portnumber> — use portnumber for scanning. and note that portnumbers do NOT appear in SSHFP records 👀
• -h, --help — output help information and exit 🙈
• -T, --timeout <seconds> — scanning timeout, in seconds (default 5) ⏱️
• -t, --type <algo> — key type to fetch. may be specified more than once. default rsa,ecdsa,ed25519,dsa,xmss 🔑
• -v, --version — output version information and exit 💜
• -q, --quiet — output less miscellany to stderr. shhh 🤫

---

✨ FILES ✨

• ~/.ssh/known_hosts

that's the one. the sacred text 📜

---

✨ REQUIREMENTS ✨

sshfp requires python-dns (http://www.pythondns.org) — no cap, you need it 🧚

• Fedora: yum install python-dns
• Debian: apt-get install python-dnspython

---

✨ BUGS ✨

bestie. listen. 💀

• if a domain contains non-working glue A records, then ssh-keyscan aborts instead of skipping the single broken entry. one bad apple and the whole thing quits. rude.
• this program can look up hashed hostnames in a known_hosts file — but only if a recent-enough ssh-keygen is present 👑

---

✨ EXAMPLES ✨

typical usage:

• sshfp (implies -k -a)
• sshfp -a -d (implies -k)
• sshfp -k bofh.nohats.ca (from known_hosts)
• sshfp -s bofh.nohats.ca (from a scan to the host)
• sshfp -k ~paul/.ssh/known_hosts bofh.nohats.ca www.openswan.org -o /tmp/mysshfp.txt
• sshfp -a -d -d nohats.ca -n ns0.nohats.ca >> /var/named/primary/nohats.ca

look at her go 😭🔥

---

✨ SEE ALSO ✨

ssh-keyscan(1) ssh(1) tlsa(1) and RFC-4255 🫶

---

✨ AUTHORS ✨

• Paul Wouters <pwouters@redhat.com>
• Jacob Appelbaum <jacob@appelbaum.net>
• James Brown <jbrown@yelp.com>

the founding mothers, respectfully 👑

---

✨ COPYRIGHT ✨

Copyright 2006-2010 Xelerance Corporation

Copyright 2012 Paul Wouters

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License (file COPYING in the distribution) for more details.

---

okay that's the whole page, you're literally a DNS icon now 💖

and that's a wrap, bestie — this one's brought to you by Paul Wouters, January 2, 2015, and the SSHFP(1) manual page. go forth and generate those records 🎀✨💅