MAKE-SSH-KNOWN-HOSTS(1)

NAME
make-ssh-known-hosts.pl - make ssh_known_hosts file from dns data

SYNOPSIS

make-ssh-known-hosts.pl
    [--initialdns initial_dns ]
    [--server domain_name_server ]
    [--subdomains comma_separated_list_if_subdomains ]
    [--debug debug_level ]
    [--timeout exec_timeout ]
    [--passwordtimeout timeout_when_asking_password ]
    [--trustdaemon]
    [--domainnamesplit]
    [--silent]
    [--nslookup path_to_nslookup_program ]
    [--ping path_to_ping_program ]
    [--pingpreoptions options_before_hostname ]
    [--pingpostoptions options_after_hostname ]
    [--ssh path_to_ssh_program ]
    domain_name [take_regexp [remove_regexp]]"

DESCRIPTION

The make-ssh-known-hosts.pl is a perl version 5 script that creates the /etc/ssh_known_hosts file that contains the public keys of known hosts. That file is used by sshd , and if the client's hostname is not found from /etc/ssh_known_hosts sshd disables .rhosts authentication. The /etc/ssh_known_hosts is also used to check that the public key returned by the remote host matches the one stored in the local /etc/ssh_known_hosts file (to prevent man-in-the-middle attacs).

The make-ssh-known-hosts.pl program finds all the hosts in the domain by making a DNS query to the master domain name server of the domain. The master domain name server is located by searching the SOA record of the domain from the initial domain name server (which can be specified with the --initialdns option). The master domain name server can also be given directly with --server option. After getting the hostname list make-ssh-known-hosts.pl tries to get the public key from every host in the domain. It first uses ping to check that the host is alive, and if it is alive it tries to run the command cat /etc/ssh_host_key.pub in the remote machine with ssh . If the command succeeds, it knows the remote machine has ssh installed properly and prints the /etc/ssh_known_hosts entry to the STDOUT .

If the command fails it checks if the ssh client got the public key from the remote host in the initial dialog, and if so, it will print a proper entry, but comment it out (unless the --trustdaemon option is given).

Domain_name is the domain name that is searched. Take_regexp is a perl regular expression that matches the host to be taken from the domain. The data matched contains all the DNS records in the form "fieldname=value ". The fields are separated with newline, and the perl match is made in multiline mode and it is case insensetive. The multiline mode means that you can use a regexp like "^wks=*telnet.*$ " to match all hosts that have WKS (well known services) field that contain value "telnet". Remove_regexp is similar but those hosts are not added that match that regexp (use it to filter out PCs and Macs with hinfo field: "^hinfo=.*(mac|pc) ").

OPTIONS

--initialdns initial_dns

-i initial_dns
    Set the initial domain name server used to query the SOA record of the domain.

--server domain_name_server

-se domain_name_server
    Set the master domain name server of the domain. This host is used to query the DNS list of the domain.

--subdomains subdomainlist

-su subdomainlist
    Comma separated list of subdomains that are added to hostnames. For example, if subdomainlist is ",foo, foo.bar, foo.bar.zappa, foo.bar.zappa.hut.fi " then when host foobar is added to /etc/ssh_known_hosts file it has aliases "foobar, foobar.foo, foobar.foo.bar, foobar.foo.bar.zappa, foobar.foo.bar.zappa.hut.fi ". The default action is to take all subparts of the host but the second last host by host basis.

--debug debug_level

-de debug_level
    Set the debug level. Default is 5, bigger values give more output. Using big value (like 999) will print lots of debugging output.

--timeout exec_timeout

-ti exec_timeout
    Timeout when executing ping or ssh commands. Default is 60 seconds.

--passwordtimeout timeout_when_asking_password

-pa timeout_when_asking_password
    Timeout when asking password for ssh command. Default is 600 seconds, use value 0 to timeout password queries immediately.

--trustdaemon

-tr If the ssh command fails, use the public key stored in the $HOME/.ssh/known_hosts file and trust it is the correct key for the host. If this option is not given such entries are commented out in the generated /etc/ssh_known_hosts file.

--domainnamesplit

-do Split the domainname to get the list of subdomains. Use this option if you don't want hostname to splitted to pieces automatically. Default splitting is done host by host basis. If the domain is zappa.hut.fi, and the host name is foo.bar then default action adds entries "foo, foo.bar, foo.bar.zappa, foo.bar.zappa.hut.fi " and this options adds entries "foo.bar, foo.bar.zappa, foo.bar.zappa.hut.fi ").

--silent

-si Be silent.

--nslookup path_to_nslookup_program

-n path_to_nslookup_program
    Path to the nslookup program.

--ping path_to_ping_program

-pi path_to_ping_program
    Path to the ping program. The full command line is: "ping preoptions hostname postoptions ".

--pingpreoptions options_before_hostname

-pingpr options_before_hostname
    Options given to ping program before hostname.

--pingpostoptions options_after_hostname

-pingpo options_after_hostname
    Options given to ping program after hostname.

--ssh path_to_ssh_program

-ss path_to_ssh_program
    Path to the ssh program.

EXAMPLES

The following command:

    example# perl5 make-ssh-known-hosts.pl cs.hut.fi > /etc/ssh_known_hosts

finds all public keys of the hosts in cs.hut.fi domain and put them to /etc/ssh_known_hosts file splitting domain names on a per host basis.

The command (if your perl5 is in /usr/local/bin):

    example% ./make-ssh-known-hosts hut.fi '^wks=.*ssh' > hut-hosts

finds all hosts in hut.fi domain that have ssh service and puts their public key to hut-hosts file. This would require that the domain name server of hut.fi would define all hosts running ssh to have entry ssh in their WKS record. Because nobody yet adds ssh to WKS, it would be better to use command

    example% ./make-ssh-known-hosts hut.fi '^wks=.*telnet' > hut-hosts

that would take those host having telnet service. This uses default subdomain list.

The command:

    example% ./make-ssh-known-hosts hut.fi 'dipoli.hut.fi' '^hinfo=.*(mac|pc)' > dipoli-hosts

finds all hosts in hut.fi domain that are in dipoli.hut.fi subdomain and that are not Mac or PC.

FILES
/etc/ssh_known_hosts    Global host public key list
~/.ssh/known_hosts    Private host public key list

SEE ALSO
ssh(1), sshd(8), ssh-keygen(1), ping(8), nslookup(8), perl(1), perlre(1)

AUTHOR
Tero Kivinen <kivinen@hut.fi>

COPYING

Permission is granted to make and distribute verbatim copies of this manual provided the copyright notice and this permission notice are preserved on all copies.

Permission is granted to copy and distribute modified versions of this manual under the conditions for verbatim copying, provided that the entire resulting derived work is distributed under the terms of a permission notice identical to this one.

Permission is granted to copy and distribute translations of this manual into another language, under the above conditions for modified versions, except that this permission notice may be included in translations approved by the the author instead of in the original English.