- djm@cvs.openbsd.org 2005/03/01 10:41:28
[ssh-keyscan.1 ssh-keyscan.c]
option to hash hostnames output by ssh-keyscan; ok markus@ deraadt@
diff --git a/ChangeLog b/ChangeLog
index b69fe2f..fd30762 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -33,6 +33,9 @@
add support for hashing host names and addresses added to known_hosts
files, to improve privacy of which hosts user have been visiting; ok
markus@ deraadt@
+ - djm@cvs.openbsd.org 2005/03/01 10:41:28
+ [ssh-keyscan.1 ssh-keyscan.c]
+ option to hash hostnames output by ssh-keyscan; ok markus@ deraadt@
20050226
- (dtucker) [openbsd-compat/bsd-openpty.c openbsd-compat/inet_ntop.c]
@@ -2209,4 +2212,4 @@
- (djm) Trim deprecated options from INSTALL. Mention UsePAM
- (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
-$Id: ChangeLog,v 1.3673 2005/03/01 10:47:37 djm Exp $
+$Id: ChangeLog,v 1.3674 2005/03/01 10:48:03 djm Exp $
diff --git a/ssh-keyscan.1 b/ssh-keyscan.1
index 9efcf52..63427e7 100644
--- a/ssh-keyscan.1
+++ b/ssh-keyscan.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-keyscan.1,v 1.18 2004/07/12 23:34:25 brad Exp $
+.\" $OpenBSD: ssh-keyscan.1,v 1.19 2005/03/01 10:41:28 djm Exp $
.\"
.\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
.\"
@@ -15,7 +15,7 @@
.Sh SYNOPSIS
.Nm ssh-keyscan
.Bk -words
-.Op Fl v46
+.Op Fl Hv46
.Op Fl p Ar port
.Op Fl T Ar timeout
.Op Fl t Ar type
@@ -46,6 +46,14 @@
.Pp
The options are as follows:
.Bl -tag -width Ds
+.It Fl H
+Hash all hostnames and addresses in the output.
+Hashed names may be used normally by
+.Nm ssh
+and
+.Nm sshd ,
+but they do not reveal identifying information should the file's contents
+be disclosed.
.It Fl p Ar port
Port to connect to on the remote host.
.It Fl T Ar timeout
diff --git a/ssh-keyscan.c b/ssh-keyscan.c
index 3cb52ac..e948670 100644
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
@@ -7,7 +7,7 @@
*/
#include "includes.h"
-RCSID("$OpenBSD: ssh-keyscan.c,v 1.50 2004/08/11 21:44:32 avsm Exp $");
+RCSID("$OpenBSD: ssh-keyscan.c,v 1.51 2005/03/01 10:41:28 djm Exp $");
#include "openbsd-compat/sys-queue.h"
@@ -28,6 +28,7 @@
#include "log.h"
#include "atomicio.h"
#include "misc.h"
+#include "hostfile.h"
/* Flag indicating whether IPv4 or IPv6. This can be set on the command line.
Default value is AF_UNSPEC means both IPv4 and IPv6. */
@@ -41,6 +42,8 @@
int get_keytypes = KT_RSA1; /* Get only RSA1 keys by default */
+int hash_hosts = 0; /* Hash hostname on output */
+
#define MAXMAXFD 256
/* The number of seconds after which to give up on a TCP connection */
@@ -366,10 +369,14 @@
static void
keyprint(con *c, Key *key)
{
+ char *host = c->c_output_name ? c->c_output_name : c->c_name;
+
if (!key)
return;
+ if (hash_hosts && (host = host_hash(host, NULL, 0)) == NULL)
+ fatal("host_hash failed");
- fprintf(stdout, "%s ", c->c_output_name ? c->c_output_name : c->c_name);
+ fprintf(stdout, "%s ", host);
key_write(key, stdout);
fputs("\n", stdout);
}
@@ -676,7 +683,7 @@
static void
usage(void)
{
- fprintf(stderr, "usage: %s [-v46] [-p port] [-T timeout] [-t type] [-f file]\n"
+ fprintf(stderr, "usage: %s [-Hv46] [-p port] [-T timeout] [-t type] [-f file]\n"
"\t\t [host | addrlist namelist] [...]\n",
__progname);
exit(1);
@@ -700,8 +707,11 @@
if (argc <= 1)
usage();
- while ((opt = getopt(argc, argv, "v46p:T:t:f:")) != -1) {
+ while ((opt = getopt(argc, argv, "Hv46p:T:t:f:")) != -1) {
switch (opt) {
+ case 'H':
+ hash_hosts = 1;
+ break;
case 'p':
ssh_port = a2port(optarg);
if (ssh_port == 0) {