How to verify host keys using PKIX-SSH and DNS
---------------------------------------------

PKIX-SSH contains support for verifying host keys using DNS as described
in https://tools.ietf.org/html/rfc4255. The document contains very brief
instructions on how to use this feature. Configuring DNS is out of the
scope of this document.
Note that public host key file may contain X.509 certificate. In this case
is used CERT RR as is described in rfc2538 obsoleted by rfc4398.


(1) Server: Generate and publish the DNS RR

To create a DNS resource record (RR) containing a fingerprint of the
public host key, use the following command:

	ssh-keygen -r hostname -f keyfile -g

where "hostname" is your fully qualified hostname and "keyfile" is the
file containing the public host key file. If you have multiple keys,
you should generate one RR for each key.

In the example above, ssh-keygen will print the fingerprint in a
generic DNS RR format parsable by most modern name server
implementations. If your nameserver has support for the SSHFP RR
you can omit the -g flag and ssh-keygen will print a standard SSHFP RR.

To publish the fingerprint using the DNS you must add the generated RR
to your DNS zone file and sign your zone.

To create a DNS CERT resource record containing X.509 host key, use the
following command:

	ssh-keygen -r hostname -f keyfile

In the example above, ssh-keygen will print a standard CERT RR. Key
algorithms are described in rfc2535 obsoleted by rfc4034. If algorithm
is not parsable by name server you should use -g flag and ssh-keygen
will print the CERT RR in a generic format parsable by most modern
name server.


(2) Client: Enable ssh to verify host keys using DNS

To enable the ssh client to verify host keys using DNS, you have to
add the following option to the ssh configuration file
($HOME/.ssh/config or /etc/ssh/ssh_config):

    VerifyHostKeyDNS yes

Upon connection the client will try to look up the CERT or SSHFP RR
using DNS. If the CERT or SSHFP received from the DNS server matches
the remote host key, the user will be notified.


	Jakob Schlyter
	Wesley Griffin
	Roumen Petrov


$OpenBSD: README.dns,v 1.2 2003/10/14 19:43:23 jakob Exp $
