Re: openssh known_hosts question

Richard E. Silverman wrote:
"Chuck" == Chuck <skilover_nospam@xxxxxxxxxxxxxx> writes:

Chuck> How does openssh know whether you've accepted a server's key
Chuck> before so as not to ask the next time 'round?

Chuck> I ran an ssh-keyscan against all servers in my known_hosts
Chuck> file, redirected the output to a new file and compared it the
Chuck> two files. They were the same so obviously it's not there. So
Chuck> where does it store that info?

If you accept a key yourself as part of an SSH session, it's stored in
~/.ssh/known_hosts. There is also a per-machine file,
/etc/ssh_known_hosts.

Note that OpenSSH does not canonicalize names; it matches what you type on
the command line verbatim against the keys in the known_hosts file (aside
from the use of patterns in that file). So if you have an entry:

foo.bar.com ssh-rsa AAAAB3NzaC1kc3MAAACBAMXXH+SzAIPRN38GehSA...

and you type "ssh foo", they will not match. You can edit thus:

foo.bar.com,foo ssh-rsa AAAAB3NzaC1kc3MAAACBAMXXH+SzAIPRN38GehSA...

... to fix this. Or, you can use Kerberos, which does canonicalize
names.


Thanks Richard. That's probably what happened. Is there a way to tell
ssh-keyscan to include the hostname, FQDN, and IP address all in the
first field?
.

Relevant Pages

  • Re: Texas Parasol Plans...
    ... The problem isn't the Canadian group that Richard blames for all his ... Richard didn't DESIGN the Texas Parasol, Chuck Beason did along with ... Also Richard refused to do a wing load test. ... wing design that was called for in the plans... ...
    (rec.aviation.homebuilt)
  • Re: Texas Parasol Plans...
    ... attracted me as a project after my actual plane is finished, ... Richard $30.00 for his CD or DVD. ... Richard didn't DESIGN the Texas Parasol, Chuck Beason did along with ... Also Richard refused to do a wing load test. ...
    (rec.aviation.homebuilt)
  • Re: Can negating a non-negative signed integer value ever overflow?
    ... article, including the attribution line, and answered the question. ... Thanks Richard, Keith and Chuck for catching me up. ... "Can negating a negative signed integer value ever overflow?" ...
    (comp.lang.c)
  • Re: openssh known_hosts question
    ... Chuck> How does openssh know whether you've accepted a server's key ... Chuck> Thanks Richard. ... Richard Silverman ...
    (comp.security.ssh)
  • Re: openssh known_hosts question
    ... Chuck> How does openssh know whether you've accepted a server's key ... Note that OpenSSH does not canonicalize names; it matches what you type on ... foo.bar.com,foo ssh-rsa AAAAB3NzaC1kc3MAAACBAMXXH+SzAIPRN38GehSA... ...
    (comp.security.ssh)