0

I wanted to get rid of some warnings I'm getting when running an automated builds environment (Scrutinizer-CI, to be precise).

Digging here, I've found this solution I can add to the script which prepares the container:

ssh-keyscan -H -p 1234 domain.tld >> ~/.ssh/known_hosts

It looks like this is not the best way to do so. Not sure if that's a matter of security or what, but the warnings about the host is gone.

The problem is that I'm still getting a warning for the IP to which the domain resolve.

I guess that this would sole the problem ssh-keyscan -H -p 1234 123.231.321.213 >> ~/.ssh/known_hosts

But what if I don't know the IP, or if the host does not always resolve to the same IP?

There is some command/script I could write to resolve the IP and pass it to the above script?

3

You could use dig to obtain the IPs and then pass them to ssh-keyscan.

Example with xargs:

dig -t a +short www.yahoo.com | grep ^[0-9] | xargs -r -n1 ssh-keyscan -H -p 1234 >> ~/.ssh/known_hosts

Example with a for loop:

for ip in $(dig -t a +short www.yahoo.com | grep ^[0-9]); do ssh-keyscan -H -p 1234 $ip; done >> ~/.ssh/known_hosts

-Rich Alloway (RogueWave)

3
  • can you explain why I would need to use | grep ^[0-9] | xargs -r -n1? Using either one or the other example, I get a bunch errors. Instead, using ssh-keyscan -H -p 10022 $(dig -t a +short domain.tld) I get what it seems to be a legit result. In fact, just dig -t a +short domain.tld returns a single IP address. Feb 3 '17 at 20:26
  • I meant to mention you, but apparently I failed: that's a second attempt :) @RichAlloway Feb 3 '17 at 20:36
  • 1
    No problem @AndreaSciamanna ! The | grep ^[0-9] only uses the IPs returned by dig (if a hostname starts with a number, the grep would need to be modified to better identify IPs). When testing with www.yahoo.com, I get two IPs and 'fd-fp3.wg1.b.yahoo.com.', which is the CNAME for www.yahoo.com, in the dig output. ssh-keyscan appears to behave with the trailing period, but I wanted to exclude the CNAME. The | xargs -r -n1 creates one execution of ssh-keyscan per result, but doesn't execute ssh-keyscan at all if there are no results. Feb 3 '17 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.