UPDATE-OPENSSH-KNOWN-HOSTS(8)

📦
version 0.6.3 · 2 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 NAME 💖

update-openssh-knwon-hosts — download, filter and merge known_hosts for OpenSSH.

(yes bestie, "knwon" is literally how it's spelled up in here, that's canon, i don't make the rules 💀)

✨ SYNOPSIS ✨

update-openssh-known-hosts [-f]

🦋 DESCRIPTION 🦋

Okay so update-openssh-known-hosts is literally the girlboss that handles the whole pipeline for you: it manages the downloading, the filtering and the merging of ssh_known_hosts files — from anywhere — into one single local file, so that ssh(1) can just vibe with it. One file, no chaos, periodt. 💅

🎀 OPTIONS 🎀

  • -f — treat every non-zero exit from a download plugin as an error. See EXIT_IGNORE below 👇

🌸 RETURN VALUES 🌸

Returns zero on success, and literally anything else on error. That's it, that's the vibe check. ✨

💜 ENVIRONMENT 💜

  • CONFDIR — the configuration directory. Defaults to /etc/openssh-known-hosts. Currently there's only a sources subdirectory hanging out in there.
  • PLUGIN_PATH — the plugin search path. Defaults to /usr/local/share/openssh-known-hosts/plugins:/usr/share/openssh-known-hosts/plugins.
  • CACHEDIR — the cache directory. Defaults to /var/cache/openssh-known-hosts.
  • LOCK — the lockfile path. Defaults to /var/lock/openssh-known-hosts.
  • OUTFILE — the output file name. Defaults to /var/lib/openssh-known-hosts/ssh_known_hosts

🌈 SOURCE DEFINITIONS 🌈

A source definition is a lil shell snippet you drop into CONFDIR/sources/, and it needs a name that's run-parts(8) compliant. Fr fr, that part matters. 🫶

There are two variables in there that aren't specific to any download plugin:

  • PLUGIN — the name of the download plugin to use. It gets searched for in PLUGIN_PATH.
  • EXIT_IGNORE — optional, space-separated list of exit codes that should be ignored. If a plugin exits with one of those, the previously downloaded version gets used instead. Iconic, honestly. 👑

👑 DOWNLOAD PLUGINS 👑

Download plugins are executables that you drop into PLUGIN_PATH, and you reference them via the PLUGIN variable inside the source definition. 🧚

A plugin gets the variables set in the source definition, handed to it in its environment. The working directory gets set to the source's cache directory. Literally all a plugin has to do is create a file named new. 🍓

current must not be touched — hands off, bestie — but it can be used as a hint to skip downloading the exact same file all over again.

stdout and stderr get connected to log, which will be output on error. And ngl, plugins don't even need to create new if it would end up identical to current. Efficient queen behaviour. ✨

💅 HOSTNAME FILTERS 💅

Place a file foo.filter right next to your source definition foo. 🎀

Each line should contain a rule — that's an action, a space, and a pattern. The first rule with a matching pattern decides everything:

  • if the action starts with a, o, p or y (for accept, admit, allow, ok, pass, permit, print, yes, ...) then the hostname gets used ✅
  • otherwise it's discarded 🗑️

And if a key ends up with no hostnames left, it gets discarded as a whole. No half-keys, no crumbs. 💀

⭐ SEE ALSO ⭐

ssh(1), sshd(8), ssh_config(5), curl(1), rsync(1), psql(1), run-parts(8)

🌸 AUTHORS 🌸

Timo Weingärtner <timo@tiwe.de>

And that's the whole page, bestie — this one's from 2014-02-03, part of the UPDATE-OPENSSH-KNOWN-HOSTS(8) manual, mwah 💋 no cap, go forth and merge your known_hosts 💖✨

📦 where this page comes from