0

i wish to create a script based solution. i know the public key that a given device should have and i can use ssh-keygen to generate a fingerprint from that key. i consider it an error if the device has a different public key or fingerprint than those i already have in my possession.

i would like to populate the known_hosts file with an entry corresponding to the public key/fingerprint that i expect the device to have. i should point out that my known_hosts file is hashed. therefore, i cannot simply add the machine name to the public key. hashing adds some complexity that places a solution out of my reach.

other answers to similar questions have either suggested setting StrictHostKeyChecking to no or populating known_hosts using either ssh or ssh-keyscan.

  • being forced to answer 'yes' at the prompt when using ssh makes the script more difficult to code (this is precisely why i wish to seed the known_hosts file in advance).

  • ssh-keyscan asks the device for its public-key and fingerprint rather than using the public-key and fingerprint that i expect it to have.

  • finally, i do not wish to change the value of StrictHostKeyChecking.

i spent a lot of time researching other questions and answers. i hope that someone can offer a different solution.

Improve this question

1 Answer 1

Reset to default
1

The known_hosts file is ju9st a list of hostnames and keys.

Let's suppose you safely got the file ssh_host_rsa_key.pub belonging to machine1.sweetjonnie.net

You could typically find it on /etc/ssh/ssh_host_rsa_key.pub at the remote system (similarly for other key types). It will look like

ssh-rsa AAAAB3NzaC1y... [email protected]

You have basically two fields, one ntroducing the type of key and a second one which is the actual key in base64. That final field [email protected] is a comment and may be discarded.

If you wanted to add this entry to your known_hosts, you would add the following line:

machine1.sweetjonnie.net ssh-rsa AAAAB3NzaC1y...

On known_hosts you have the same contents, prepended by the hostname or ip it applies to.

If you have keys for multiple hosts, you might want to script it, but the actual commands will depend on how you have them stored (folders/filenames structure).

Improve this answer
4
  • Added to that, if you have a known_hosts file that has everything you need you can simply copy it to other systems.
    – davidgo
    Sep 17, 2020 at 6:00
  • @Angel, i failed to provide pertinent information and i apologize. my known_hosts file is hashed. much of the difficulty arises from dealing with hashing and salting. i have edited my question and i hope that this rectifies the omission.
    – sweetjonnie
    Sep 17, 2020 at 15:49
  • @Angel, i guess that i can manually add the entry from your answer to known_hosts and then use ssh-keygen -H -f <<path-to-known_hosts>> to hash the host-name. i would have preferred to prepare a single record and then append it, but this does answer the question.
    – sweetjonnie
    Sep 17, 2020 at 17:56
  • Do note that you are not required to have a hashed known_hosts. You can also mix hashed and unhashed entries. IMHO the protection that gives you (not knowing which hosts you connect to) is trivial (targets will be there on history files, .ssh/config, etc.) while having important drawbacks.
    – Ángel
    Sep 17, 2020 at 23:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .