1

I have an entry from an OpenSSH known_hosts file; I'd like to generate an SSHFP resource record for this. I can use ssh-keygen to generate the fingerprint with no difficulty:

$ ssh-keygen -f foo_known_host -l
1040 09:a0:5c:5f:43:fb:e5:25:d8:0c:d8:dc:d7:7a:c4:62 foo.example.com. (RSA)

But it doesn't seem to like it for a DNS fingerprint record:

$  ssh-keygen -f foo_known_host -r foo
failed to read v2 public key from foo_known_host.

So how do I do this?

Note: If you came here via asking a search engine how to generate an SSHFP record from a remote host (not a local copy of the fingerprint as above), that's done via ssh-keyscan -D machine.name –.

Improve this question
4
  • 1
    If the question that brought you here is "How do I generate an SSHFP record from a remote machine (like a router)" the answer is: ssh-keyscan -D machine.name
    – Graham Leggett
    Sep 8, 2020 at 16:10
  • @GrahamLeggett No; that is not my question. As I state in my question above, I want to do this from a known_hosts file entry, not by accessing the remote machine.
    – cjs
    Sep 10, 2020 at 2:15
  • I know that is not your question, as I made clear in the comment above. Google however is not good at distinguishing between similar questions, thus the comment above.
    – Graham Leggett
    Sep 10, 2020 at 9:53
  • @GrahamLeggett Oh, I thought the comment was aimed at me, not others reading this question. I understand the issue you're trying to fix now, and have updated the question with your note, which I hope will help with this. Thanks for the clarification!
    – cjs
    Sep 12, 2020 at 8:10

3 Answers 3

Reset to default
2

ssh-keygen(1) doesn't behave the same way as sshfp(1).

You'll note from the man page that the syntax is:

ssh-keygen -r hostname [-f input_keyfile] [-g]

So the file should be an input_keyfile rather than a known_hosts_file. If you don't specify then it will default to the server's local keys of /etc/ssh/ssh_host_rsa_key.pub and /etc/ssh/ssh_host_dsa_key.pub.

You can either generate the record from each server that you wish to create SSHFP records for with ssh-keygen. Or source sshfp and create them all from one known_hosts file.

Improve this answer
0

This script is good:

http://brmlab.cz/kb/sshfp.sh

It needs to be run in /etc/ssh, or edit it to cd there before it does it's stuff.

Improve this answer
-1

try -r $HOSTNAME as first arguement:

$ ssh-keygen -r moppel -f ~/.ssh/id_dsa -g
moppel IN TYPE44 \# 22 02 01 3950bf0c2cf2318b9ab2187992b6f7869947c3aa
Improve this answer
1
  • 1
    No, switching around the arguments doesn't work. You got probably got correct output because you gave it a v2 public key file, not a known_hosts file with one entry.
    – cjs
    Jul 7, 2009 at 10:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .