Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 1 | .\" $OpenBSD: ssh-keyscan.1,v 1.36 2014/08/30 15:33:50 sobrado Exp $ |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 2 | .\" |
| 3 | .\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>. |
| 4 | .\" |
| 5 | .\" Modification and redistribution in source and binary forms is |
| 6 | .\" permitted provided that due credit is given to the author and the |
| 7 | .\" OpenBSD project by leaving this copyright notice intact. |
| 8 | .\" |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 9 | .Dd $Mdocdate: August 30 2014 $ |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 10 | .Dt SSH-KEYSCAN 1 |
| 11 | .Os |
| 12 | .Sh NAME |
| 13 | .Nm ssh-keyscan |
| 14 | .Nd gather ssh public keys |
| 15 | .Sh SYNOPSIS |
| 16 | .Nm ssh-keyscan |
| 17 | .Bk -words |
| 18 | .Op Fl 46Hv |
| 19 | .Op Fl f Ar file |
| 20 | .Op Fl p Ar port |
| 21 | .Op Fl T Ar timeout |
| 22 | .Op Fl t Ar type |
| 23 | .Op Ar host | addrlist namelist |
| 24 | .Ar ... |
| 25 | .Ek |
| 26 | .Sh DESCRIPTION |
| 27 | .Nm |
| 28 | is a utility for gathering the public ssh host keys of a number of |
| 29 | hosts. |
| 30 | It was designed to aid in building and verifying |
| 31 | .Pa ssh_known_hosts |
| 32 | files. |
| 33 | .Nm |
| 34 | provides a minimal interface suitable for use by shell and perl |
| 35 | scripts. |
| 36 | .Pp |
| 37 | .Nm |
| 38 | uses non-blocking socket I/O to contact as many hosts as possible in |
| 39 | parallel, so it is very efficient. |
| 40 | The keys from a domain of 1,000 |
| 41 | hosts can be collected in tens of seconds, even when some of those |
| 42 | hosts are down or do not run ssh. |
| 43 | For scanning, one does not need |
| 44 | login access to the machines that are being scanned, nor does the |
| 45 | scanning process involve any encryption. |
| 46 | .Pp |
| 47 | The options are as follows: |
| 48 | .Bl -tag -width Ds |
| 49 | .It Fl 4 |
| 50 | Forces |
| 51 | .Nm |
| 52 | to use IPv4 addresses only. |
| 53 | .It Fl 6 |
| 54 | Forces |
| 55 | .Nm |
| 56 | to use IPv6 addresses only. |
| 57 | .It Fl f Ar file |
| 58 | Read hosts or |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 59 | .Dq addrlist namelist |
| 60 | pairs from |
| 61 | .Ar file , |
| 62 | one per line. |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 63 | If |
| 64 | .Pa - |
| 65 | is supplied instead of a filename, |
| 66 | .Nm |
| 67 | will read hosts or |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 68 | .Dq addrlist namelist |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 69 | pairs from the standard input. |
| 70 | .It Fl H |
| 71 | Hash all hostnames and addresses in the output. |
| 72 | Hashed names may be used normally by |
| 73 | .Nm ssh |
| 74 | and |
| 75 | .Nm sshd , |
| 76 | but they do not reveal identifying information should the file's contents |
| 77 | be disclosed. |
| 78 | .It Fl p Ar port |
| 79 | Port to connect to on the remote host. |
| 80 | .It Fl T Ar timeout |
| 81 | Set the timeout for connection attempts. |
| 82 | If |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 83 | .Ar timeout |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 84 | seconds have elapsed since a connection was initiated to a host or since the |
| 85 | last time anything was read from that host, then the connection is |
| 86 | closed and the host in question considered unavailable. |
| 87 | Default is 5 seconds. |
| 88 | .It Fl t Ar type |
| 89 | Specifies the type of the key to fetch from the scanned hosts. |
| 90 | The possible values are |
| 91 | .Dq rsa1 |
| 92 | for protocol version 1 and |
| 93 | .Dq dsa , |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 94 | .Dq ecdsa , |
| 95 | .Dq ed25519 , |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 96 | or |
| 97 | .Dq rsa |
| 98 | for protocol version 2. |
| 99 | Multiple values may be specified by separating them with commas. |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 100 | The default is to fetch |
| 101 | .Dq rsa , |
| 102 | .Dq ecdsa , |
| 103 | and |
| 104 | .Dq ed25519 |
| 105 | keys. |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 106 | .It Fl v |
| 107 | Verbose mode. |
| 108 | Causes |
| 109 | .Nm |
| 110 | to print debugging messages about its progress. |
| 111 | .El |
| 112 | .Sh SECURITY |
| 113 | If an ssh_known_hosts file is constructed using |
| 114 | .Nm |
| 115 | without verifying the keys, users will be vulnerable to |
| 116 | .Em man in the middle |
| 117 | attacks. |
| 118 | On the other hand, if the security model allows such a risk, |
| 119 | .Nm |
| 120 | can help in the detection of tampered keyfiles or man in the middle |
| 121 | attacks which have begun after the ssh_known_hosts file was created. |
| 122 | .Sh FILES |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 123 | Input format: |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 124 | .Bd -literal |
| 125 | 1.2.3.4,1.2.4.4 name.my.domain,name,n.my.domain,n,1.2.3.4,1.2.4.4 |
| 126 | .Ed |
| 127 | .Pp |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 128 | Output format for RSA1 keys: |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 129 | .Bd -literal |
| 130 | host-or-namelist bits exponent modulus |
| 131 | .Ed |
| 132 | .Pp |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 133 | Output format for RSA, DSA, ECDSA, and Ed25519 keys: |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 134 | .Bd -literal |
| 135 | host-or-namelist keytype base64-encoded-key |
| 136 | .Ed |
| 137 | .Pp |
| 138 | Where |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 139 | .Ar keytype |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 140 | is either |
| 141 | .Dq ecdsa-sha2-nistp256 , |
| 142 | .Dq ecdsa-sha2-nistp384 , |
| 143 | .Dq ecdsa-sha2-nistp521 , |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 144 | .Dq ssh-ed25519 , |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 145 | .Dq ssh-dss |
| 146 | or |
| 147 | .Dq ssh-rsa . |
| 148 | .Pp |
| 149 | .Pa /etc/ssh/ssh_known_hosts |
| 150 | .Sh EXAMPLES |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 151 | Print the rsa host key for machine |
| 152 | .Ar hostname : |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 153 | .Bd -literal |
| 154 | $ ssh-keyscan hostname |
| 155 | .Ed |
| 156 | .Pp |
| 157 | Find all hosts from the file |
| 158 | .Pa ssh_hosts |
| 159 | which have new or different keys from those in the sorted file |
| 160 | .Pa ssh_known_hosts : |
| 161 | .Bd -literal |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 162 | $ ssh-keyscan -t rsa,dsa,ecdsa,ed25519 -f ssh_hosts | \e |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 163 | sort -u - ssh_known_hosts | diff ssh_known_hosts - |
| 164 | .Ed |
| 165 | .Sh SEE ALSO |
| 166 | .Xr ssh 1 , |
| 167 | .Xr sshd 8 |
| 168 | .Sh AUTHORS |
| 169 | .An -nosplit |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 170 | .An David Mazieres Aq Mt dm@lcs.mit.edu |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 171 | wrote the initial version, and |
Adam Langley | d059297 | 2015-03-30 14:49:51 -0700 | [diff] [blame^] | 172 | .An Wayne Davison Aq Mt wayned@users.sourceforge.net |
Greg Hartman | bd77cf7 | 2015-02-25 13:21:06 -0800 | [diff] [blame] | 173 | added support for protocol version 2. |
| 174 | .Sh BUGS |
| 175 | It generates "Connection closed by remote host" messages on the consoles |
| 176 | of all the machines it scans if the server is older than version 2.9. |
| 177 | This is because it opens a connection to the ssh port, reads the public |
| 178 | key, and drops the connection as soon as it gets the key. |