Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an entry from an OpenSSH known_hosts file; I'd like to generate an SSHFP resource record for this. I can use ssh-keygen to generate the fingerprint with no difficulty:

$ ssh-keygen -f foo_known_host -l
1040 09:a0:5c:5f:43:fb:e5:25:d8:0c:d8:dc:d7:7a:c4:62 foo.example.com. (RSA)

But it doesn't seem to like it for a DNS fingerprint record:

$  ssh-keygen -f foo_known_host -r foo
failed to read v2 public key from foo_known_host.

So how do I do this?

share|improve this question
add comment

3 Answers 3

ssh-keygen(1) doesn't behave the same way as sshfp(1).

You'll note from the man page that the syntax is:

ssh-keygen -r hostname [-f input_keyfile] [-g]

So the file should be an input_keyfile rather than a known_hosts_file. If you don't specify then it will default to the server's local keys of /etc/ssh/ssh_host_rsa_key.pub and /etc/ssh/ssh_host_dsa_key.pub.

You can either generate the record from each server that you wish to create SSHFP records for with ssh-keygen. Or source sshfp and create them all from one known_hosts file.

share|improve this answer
add comment

This script is good:

http://brmlab.cz/kb/sshfp.sh

It needs to be run in /etc/ssh, or edit it to cd there before it does it's stuff.

share|improve this answer
add comment

try -r $HOSTNAME as first arguement:

$ ssh-keygen -r moppel -f ~/.ssh/id_dsa -g
moppel IN TYPE44 \# 22 02 01 3950bf0c2cf2318b9ab2187992b6f7869947c3aa
share|improve this answer
    
No, switching around the arguments doesn't work. You got probably got correct output because you gave it a v2 public key file, not a known_hosts file with one entry. –  Curt Sampson Jul 7 '09 at 10:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.