Damien Miller | 7af3d10 | 2002-02-19 15:19:42 +1100 | [diff] [blame^] | 1 | .\" $OpenBSD: ssh-keyscan.1,v 1.14 2002/02/13 08:33:47 mpech Exp $ |
Ben Lindstrom | b22c2b8 | 2001-03-05 06:50:47 +0000 | [diff] [blame] | 2 | .\" |
| 3 | .\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>. |
| 4 | .\" |
| 5 | .\" Modification and redistribution in source and binary forms is |
| 6 | .\" permitted provided that due credit is given to the author and the |
Ben Lindstrom | a238f6e | 2001-06-09 01:30:39 +0000 | [diff] [blame] | 7 | .\" OpenBSD project by leaving this copyright notice intact. |
Ben Lindstrom | 36579d3 | 2001-01-29 07:39:26 +0000 | [diff] [blame] | 8 | .\" |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 9 | .Dd January 1, 1996 |
Ben Lindstrom | b22c2b8 | 2001-03-05 06:50:47 +0000 | [diff] [blame] | 10 | .Dt SSH-KEYSCAN 1 |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 11 | .Os |
| 12 | .Sh NAME |
| 13 | .Nm ssh-keyscan |
| 14 | .Nd gather ssh public keys |
| 15 | .Sh SYNOPSIS |
| 16 | .Nm ssh-keyscan |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 17 | .Op Fl v46 |
| 18 | .Op Fl p Ar port |
| 19 | .Op Fl T Ar timeout |
| 20 | .Op Fl t Ar type |
| 21 | .Op Fl f Ar file |
| 22 | .Op Ar host | addrlist namelist |
| 23 | .Op Ar ... |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 24 | .Sh DESCRIPTION |
| 25 | .Nm |
| 26 | is a utility for gathering the public ssh host keys of a number of |
| 27 | hosts. It was designed to aid in building and verifying |
| 28 | .Pa ssh_known_hosts |
| 29 | files. |
| 30 | .Nm |
| 31 | provides a minimal interface suitable for use by shell and perl |
| 32 | scripts. |
| 33 | .Pp |
| 34 | .Nm |
| 35 | uses non-blocking socket I/O to contact as many hosts as possible in |
| 36 | parallel, so it is very efficient. The keys from a domain of 1,000 |
| 37 | hosts can be collected in tens of seconds, even when some of those |
Ben Lindstrom | 594e203 | 2001-09-12 18:35:30 +0000 | [diff] [blame] | 38 | hosts are down or do not run ssh. For scanning, one does not need |
| 39 | login access to the machines that are being scanned, nor does the |
| 40 | scanning process involve any encryption. |
Ben Lindstrom | 0b5afb9 | 2001-08-06 22:01:29 +0000 | [diff] [blame] | 41 | .Pp |
| 42 | The options are as follows: |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 43 | .Bl -tag -width Ds |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 44 | .It Fl p Ar port |
| 45 | Port to connect to on the remote host. |
Ben Lindstrom | 8d066fb | 2001-09-12 17:06:13 +0000 | [diff] [blame] | 46 | .It Fl T Ar timeout |
Ben Lindstrom | 2464322 | 2001-06-25 05:08:11 +0000 | [diff] [blame] | 47 | Set the timeout for connection attempts. If |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 48 | .Pa timeout |
| 49 | seconds have elapsed since a connection was initiated to a host or since the |
| 50 | last time anything was read from that host, then the connection is |
| 51 | closed and the host in question considered unavailable. Default is 5 |
| 52 | seconds. |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 53 | .It Fl t Ar type |
Ben Lindstrom | 8d066fb | 2001-09-12 17:06:13 +0000 | [diff] [blame] | 54 | Specifies the type of the key to fetch from the scanned hosts. |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 55 | The possible values are |
| 56 | .Dq rsa1 |
| 57 | for protocol version 1 and |
| 58 | .Dq rsa |
| 59 | or |
| 60 | .Dq dsa |
| 61 | for protocol version 2. |
| 62 | Multiple values may be specified by separating them with commas. |
| 63 | The default is |
| 64 | .Dq rsa1 . |
| 65 | .It Fl f Ar filename |
Ben Lindstrom | 2464322 | 2001-06-25 05:08:11 +0000 | [diff] [blame] | 66 | Read hosts or |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 67 | .Pa addrlist namelist |
| 68 | pairs from this file, one per line. |
| 69 | If |
| 70 | .Pa - |
| 71 | is supplied instead of a filename, |
| 72 | .Nm |
Ben Lindstrom | 2464322 | 2001-06-25 05:08:11 +0000 | [diff] [blame] | 73 | will read hosts or |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 74 | .Pa addrlist namelist |
| 75 | pairs from the standard input. |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 76 | .It Fl v |
| 77 | Verbose mode. |
| 78 | Causes |
| 79 | .Nm |
| 80 | to print debugging messages about its progress. |
| 81 | .It Fl 4 |
| 82 | Forces |
| 83 | .Nm |
| 84 | to use IPv4 addresses only. |
| 85 | .It Fl 6 |
| 86 | Forces |
| 87 | .Nm |
| 88 | to use IPv6 addresses only. |
Ben Lindstrom | d26dcf3 | 2001-01-06 15:18:16 +0000 | [diff] [blame] | 89 | .El |
Ben Lindstrom | 0b5afb9 | 2001-08-06 22:01:29 +0000 | [diff] [blame] | 90 | .Sh SECURITY |
Ben Lindstrom | 594e203 | 2001-09-12 18:35:30 +0000 | [diff] [blame] | 91 | If a ssh_known_hosts file is constructed using |
Ben Lindstrom | 0b5afb9 | 2001-08-06 22:01:29 +0000 | [diff] [blame] | 92 | .Nm |
Ben Lindstrom | 594e203 | 2001-09-12 18:35:30 +0000 | [diff] [blame] | 93 | without verifying the keys, users will be vulnerable to |
Ben Lindstrom | 0b5afb9 | 2001-08-06 22:01:29 +0000 | [diff] [blame] | 94 | .I man in the middle |
| 95 | attacks. |
Ben Lindstrom | 594e203 | 2001-09-12 18:35:30 +0000 | [diff] [blame] | 96 | On the other hand, if the security model allows such a risk, |
Ben Lindstrom | 0b5afb9 | 2001-08-06 22:01:29 +0000 | [diff] [blame] | 97 | .Nm |
Ben Lindstrom | 594e203 | 2001-09-12 18:35:30 +0000 | [diff] [blame] | 98 | can help in the detection of tampered keyfiles or man in the middle |
| 99 | attacks which have begun after the ssh_known_hosts file was created. |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 100 | .Sh EXAMPLES |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 101 | .Pp |
| 102 | Print the |
| 103 | .Pa rsa1 |
| 104 | host key for machine |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 105 | .Pa hostname : |
| 106 | .Bd -literal |
Damien Miller | 7af3d10 | 2002-02-19 15:19:42 +1100 | [diff] [blame^] | 107 | $ ssh-keyscan hostname |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 108 | .Ed |
| 109 | .Pp |
| 110 | Find all hosts from the file |
| 111 | .Pa ssh_hosts |
| 112 | which have new or different keys from those in the sorted file |
| 113 | .Pa ssh_known_hosts : |
| 114 | .Bd -literal |
Damien Miller | 7af3d10 | 2002-02-19 15:19:42 +1100 | [diff] [blame^] | 115 | $ ssh-keyscan -t rsa,dsa -f ssh_hosts | \e\ |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 116 | sort -u - ssh_known_hosts | diff ssh_known_hosts - |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 117 | .Ed |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 118 | .Sh FILES |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 119 | .Pa Input format: |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 120 | .Bd -literal |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 121 | 1.2.3.4,1.2.4.4 name.my.domain,name,n.my.domain,n,1.2.3.4,1.2.4.4 |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 122 | .Ed |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 123 | .Pp |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 124 | .Pa Output format for rsa1 keys: |
| 125 | .Bd -literal |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 126 | host-or-namelist bits exponent modulus |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 127 | .Ed |
| 128 | .Pp |
| 129 | .Pa Output format for rsa and dsa keys: |
| 130 | .Bd -literal |
| 131 | host-or-namelist keytype base64-encoded-key |
| 132 | .Ed |
| 133 | .Pp |
| 134 | Where |
| 135 | .Pa keytype |
| 136 | is either |
| 137 | .Dq ssh-rsa |
| 138 | or |
| 139 | .Dq ssh-dsa . |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 140 | .Pp |
Damien Miller | 05eda43 | 2002-02-10 18:32:28 +1100 | [diff] [blame] | 141 | .Pa /etc/ssh/ssh_known_hosts |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 142 | .Sh BUGS |
| 143 | It generates "Connection closed by remote host" messages on the consoles |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 144 | of all the machines it scans if the server is older than version 2.9. |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 145 | This is because it opens a connection to the ssh port, reads the public |
| 146 | key, and drops the connection as soon as it gets the key. |
| 147 | .Sh SEE ALSO |
Ben Lindstrom | b22c2b8 | 2001-03-05 06:50:47 +0000 | [diff] [blame] | 148 | .Xr ssh 1 , |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 149 | .Xr sshd 8 |
Ben Lindstrom | d2bf0d6 | 2001-06-25 04:10:54 +0000 | [diff] [blame] | 150 | .Sh AUTHORS |
Ben Lindstrom | b6434ae | 2000-12-05 01:15:09 +0000 | [diff] [blame] | 151 | David Mazieres <dm@lcs.mit.edu> |
Ben Lindstrom | 325e70c | 2001-08-06 22:41:30 +0000 | [diff] [blame] | 152 | wrote the initial version, and |
| 153 | Wayne Davison <wayned@users.sourceforge.net> |
| 154 | added support for protocol version 2. |