Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / openssh / 0b5afb98eba742712a30509778e3a1e73c16cea3 / . / ssh-keyscan.1
blob: 80119aa217b43838efc782efb99a1296f66503a0 [file] [log] [blame]
Ben Lindstrom0b5afb92001-08-06 22:01:29 +0000[diff] [blame^]1.\" $OpenBSD: ssh-keyscan.1,v 1.9 2001/08/02 18:37:35 mpech Exp $
Ben Lindstromb22c2b82001-03-05 06:50:47 +0000[diff] [blame]2.\"
3.\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
4.\"
5.\" Modification and redistribution in source and binary forms is
6.\" permitted provided that due credit is given to the author and the
Ben Lindstroma238f6e2001-06-09 01:30:39 +0000[diff] [blame]7.\" OpenBSD project by leaving this copyright notice intact.
Ben Lindstrom36579d32001-01-29 07:39:26 +0000[diff] [blame]8.\"
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]9.Dd January 1, 1996
Ben Lindstromb22c2b82001-03-05 06:50:47 +0000[diff] [blame]10.Dt SSH-KEYSCAN 1
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]11.Os
12.Sh NAME
13.Nm ssh-keyscan
14.Nd gather ssh public keys
15.Sh SYNOPSIS
16.Nm ssh-keyscan
17.Op Fl t Ar timeout
18.Op Ar -- | host | addrlist namelist
19.Op Fl f Ar files ...
20.Sh DESCRIPTION
21.Nm
22is a utility for gathering the public ssh host keys of a number of
23hosts. It was designed to aid in building and verifying
24.Pa ssh_known_hosts
25files.
26.Nm
27provides a minimal interface suitable for use by shell and perl
28scripts.
29.Pp
30.Nm
31uses non-blocking socket I/O to contact as many hosts as possible in
32parallel, so it is very efficient. The keys from a domain of 1,000
33hosts can be collected in tens of seconds, even when some of those
34hosts are down or do not run ssh. You do not need login access to the
Ben Lindstromf73e05e2001-04-19 20:31:02 +0000[diff] [blame]35machines you are scanning, nor does the scanning process involve
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]36any encryption.
Ben Lindstrom0b5afb92001-08-06 22:01:29 +0000[diff] [blame^]37.Pp
38The options are as follows:
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]39.Bl -tag -width Ds
40.It Fl t
Ben Lindstrom24643222001-06-25 05:08:11 +0000[diff] [blame]41Set the timeout for connection attempts. If
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]42.Pa timeout
43seconds have elapsed since a connection was initiated to a host or since the
44last time anything was read from that host, then the connection is
45closed and the host in question considered unavailable. Default is 5
46seconds.
47.It Fl f
Ben Lindstrom24643222001-06-25 05:08:11 +0000[diff] [blame]48Read hosts or
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]49.Pa addrlist namelist
50pairs from this file, one per line.
51If
52.Pa -
53is supplied instead of a filename,
54.Nm
Ben Lindstrom24643222001-06-25 05:08:11 +0000[diff] [blame]55will read hosts or
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]56.Pa addrlist namelist
57pairs from the standard input.
Ben Lindstromd26dcf32001-01-06 15:18:16 +0000[diff] [blame]58.El
Ben Lindstrom0b5afb92001-08-06 22:01:29 +0000[diff] [blame^]59.Sh SECURITY
60If you make an ssh_known_hosts file using
61.Nm
62without verifying the keys, you will be vulnerable to
63.I man in the middle
64attacks.
65On the other hand, if your security model allows such a risk,
66.Nm
67can help you detect tampered keyfiles or man in the middle attacks which
68have begun after you created your ssh_known_hosts file.
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]69.Sh EXAMPLES
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]70Print the host key for machine
71.Pa hostname :
72.Bd -literal
73ssh-keyscan hostname
74.Ed
75.Pp
76Find all hosts from the file
77.Pa ssh_hosts
78which have new or different keys from those in the sorted file
79.Pa ssh_known_hosts :
80.Bd -literal
Ben Lindstromb22c2b82001-03-05 06:50:47 +0000[diff] [blame]81$ ssh-keyscan -f ssh_hosts | sort -u - ssh_known_hosts | \e\
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]82 diff ssh_known_hosts -
83.Ed
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]84.Sh FILES
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]85.Pa Input format:
861.2.3.4,1.2.4.4 name.my.domain,name,n.my.domain,n,1.2.3.4,1.2.4.4
87.Pp
88.Pa Output format:
89host-or-namelist bits exponent modulus
90.Pp
91.Pa /etc/ssh_known_hosts
92.Sh BUGS
93It generates "Connection closed by remote host" messages on the consoles
94of all the machines it scans.
95This is because it opens a connection to the ssh port, reads the public
96key, and drops the connection as soon as it gets the key.
97.Sh SEE ALSO
Ben Lindstromb22c2b82001-03-05 06:50:47 +0000[diff] [blame]98.Xr ssh 1 ,
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]99.Xr sshd 8
Ben Lindstromd2bf0d62001-06-25 04:10:54 +0000[diff] [blame]100.Sh AUTHORS
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000[diff] [blame]101David Mazieres <dm@lcs.mit.edu>