0

I am using ssh-keyscan in a shell script to accept keys for hosts. The hosts are identified by hostname but not in /etc/hosts. They are in ./ssh/config so I can ssh <hostname> but I can not ping etc.

It looks like ssh-keyscan is not using the .ssh/config file and that seems funny.

Can someone confirm this happens to them?

Real question: Does someone have a way to make ssh-keyscan use ~/.ssh/config?

stone.212
  • 247
  • 2
  • 11

2 Answers2

2

ssh-keyscan doesn't and cannot be made to use .ssh/config.

However, what you are asking for doesn't require it to do so: Simply passing the real hostnames/addresses to ssh-keyscan (and thus storing them in the known_hosts) will work, even if you use the aliases from the config with ssh. But you can even instruct ssh-keyscan to add other names to the output besides those it used to connect when using the -f option:

 -f file
         Read hosts or “addrlist namelist” pairs from file, one per line.
         If - is supplied instead of a filename, ssh-keyscan will read
         hosts or “addrlist namelist” pairs from the standard input.
jplitza
  • 329
  • 1
  • 10
  • 1
    It's not an answer I wanted and it doesn't help me but I guess it is the correct answer. Thank you. – stone.212 Sep 05 '19 at 03:16
  • If ssh-keyscan can't read ~/.ssh/config, then it can't (?) get keys from machines behind a jumpserver (e.g., using ProxyJump keyword, see `man ssh_config`). I justed that and got this result: `getaddrinfo foo.company.com: nodename nor servname provided, or not known` – mellow-yellow Oct 08 '19 at 15:51
  • For jump server set-ups, [here's a relevant solution](https://serverfault.com/a/823719/335080). – worldsayshi Oct 09 '19 at 16:16
0

ssh-keyscan is a utility for gathering the public ssh host keys of a number of hosts. It was designed to aid in building and verifying **ssh_known_hosts** files. ssh-keyscan provides a minimal interface suitable for use by shell and perl scripts.

-f file
Read hosts or addrlist namelist pairs from this file, one per line. If - is supplied instead of a filename, ssh-keyscan will read hosts or addrlist namelist pairs from the standard input.


Input format: 
1.2.3.4,1.2.4.4 name.my.domain,name,n.my.domain,n,1.2.3.4,1.2.4.4

Output format for rsa1 keys:
host-or-namelist bits exponent modulus

Output format for rsa and dsa keys:
host-or-namelist keytype base64-encoded-key

Where keytype is either ''ssh-rsa'' or ''ssh-dss''.
/etc/ssh/ssh_known_hosts

For Example: 

Print the rsa host key for machine hostname:
$ ssh-keyscan hostname

Find all hosts from the file ssh_hosts which have new or different keys from those in the sorted file ssh_known_hosts:
$ ssh-keyscan -t rsa,dsa -f ssh_hosts | sort -u - ssh_known_hosts | diff ssh_known_hosts -
asktyagi
  • 2,401
  • 1
  • 5
  • 19