I need to setup SSHFP records in the DNS for my host. I have done some searching but I haven't found any good example.
- What are SSHFP records?
- What does SSHFP records look like?
- How do I create SSHFP records?
What are SSHFP records?
SSHFP RR records are DNS records that contain fingerprints for public keys used for SSH. They're mostly used with DNSSEC enabled domains. When a SSH client connects to a server it checks the corresponding SSHFP record. If the records fingerprint matches the servers, the server is legit and it's safe to connect.
What does SSHFP records look like?
SSHFP records consist of three things:
There are four different algorithms defined in SSHFP as of 2015. Each algorithm is represented by an integer. The algorithms are:
Two fingerprint types are defined in SSHFP as of 2012. Each fingerprint type is represented by an integer. These are:
How do I generate SSHFP records?
You can use
Using ssh-keygen and CentOS 6:
I'm not sure if
A records such as mentioned...
...exist of 6 parts:
To make use of it, put
If you use Puppet,
Older versions of ssh-keygen don't generate all the available keys (eg. no support for ecdsa and sha256). This script does creates all the records for all available keys in
Edit: New Version with PR from alex-dupuy with *BSD support.