SSS_SSH_KNOWNHOSTS(1)

📦
version 2.13.1 · 16 versions
, in centos-stream 10

🦋 sss_ssh_knownhosts(1) — the SSSD manual page, bestie edition 🦋

okay so this is a page from SSSD Manual pages, yes the whole sss_ssh_knownhosts(1) of it, and I'm gonna walk you through it like we're texting at 2am 💖

✨ NAME ✨

sss_ssh_knownhosts — literally the thing that gets you OpenSSH known hosts public keys. that's it, that's the job 🎀

🌸 SYNOPSIS 🌸

sss_ssh_knownhosts [options] HOST

so you give it a HOST and some options and she goes to work 💅

💜 DESCRIPTION 💜

okay so sss_ssh_knownhosts acquires SSH public keys for the host HOST — like, it goes and fetches them — and then it outputs them in the OpenSSH known_hosts key format. if you wanna know the nitty gritty of that format, go peek at the “SSH_KNOWN_HOSTS FILE FORMAT” section of sshd(8), iykyk 🫶

and here's the icon behavior: ssh(1) can be configured to use sss_ssh_knownhosts for public key host authentication using the “KnownHostsCommand” option, like so:

KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H

please please please refer to the ssh_config(5) man page for more deets about this option, no cap 💀

⭐ heads up bestie: this tool requires that SSSD's ssh service is enabled to work properly. like, actually enabled. don't come for me if it's off 🌈

🎀 OPTIONS 🎀

  • -d, --domain DOMAIN — search for host public keys in SSSD domain DOMAIN. you pick the domain, she searches there 🔥
  • -o, --only-host-name — okay so when the keys retrieved from the backend do not include the hostname, this tool will add the unmodified hostname as provided by the caller. but if this flag is set, only the hostname (no port number) will be added to the keys. lowkey a subtle difference but it matters 💅
  • -?, --help — display help message and exit. the classic. the icon 👑

🧚 KEY RETRIEVAL 🧚

so the key lines retrieved from the backend are expected to respect the key format as described in the “SSH_KNOWN_HOSTS FILE FORMAT” section of sshd(8). but like, being chill about it — returning only the keytype and the key itself is tolerated 🫶 in which case, the hostname received as parameter will be added before the keytype to output a correctly formatted line. and the hostname will be added unmodified or just the hostname (no port number), depending on whether the -o,--only-host-name option was provided ✨

💀 now this part is highkey important: when the SSH server is listening on a non-default port, the backend MUST provide the hostname including the port number in the correct format and position as part of the key line. no wiggle room, no vibes-based guessing. for example, the minimal key line would be:
[canonical.host.name]:2222 <keytype> <base64-encoded key>

see how the port is right there in the brackets? that's the assignment and she ate 🍓

🌈 EXIT STATUS 🌈

  • in case of successful execution, 0 is returned — and yes, even if no key was found for that host, or even if the ssh responder could not be contacted. still 0. she's unbothered 💅
  • 1 is returned in case of any other error. that's the "something actually went wrong" number 😭

👑 SEE ALSO 👑

sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5) sssd-systemtap(5)

like, the whole friend group, fr fr 🦋

💖 AUTHORS 💖

The SSSD upstream — https://github.com/SSSD/sssd/ 🫶

and that's the whole page bestie!! this one's brought to you by SSSD, dated 09/08/2026, and yeah the manual page is literally also called SSS_SSH_KNOWNHOSTS(1) — main character energy, she named the page after herself 💅✨ periodt 🎀

📦 where this page comes from