Home / server / Questions / 943774
Accepted
stone.212
Asked: 2018-12-11 20:33:52 +0800 CST

ssh-keyscan does not read .ssh/config?

  • 772

I am using ssh-keyscan in a shell script to accept keys for hosts. The hosts are identified by hostname but not in /etc/hosts. They are in ./ssh/config so I can ssh <hostname> but I can not ping etc.

It looks like ssh-keyscan is not using the .ssh/config file and that seems funny.

Can someone confirm this happens to them?

Real question: Does someone have a way to make ssh-keyscan use ~/.ssh/config?

ssh

2 Answers

  1. Best Answer

    ssh-keyscan doesn't and cannot be made to use .ssh/config.

    However, what you are asking for doesn't require it to do so: Simply passing the real hostnames/addresses to ssh-keyscan (and thus storing them in the known_hosts) will work, even if you use the aliases from the config with ssh. But you can even instruct ssh-keyscan to add other names to the output besides those it used to connect when using the -f option:

     -f file
         Read hosts or “addrlist namelist” pairs from file, one per line.
         If - is supplied instead of a filename, ssh-keyscan will read
         hosts or “addrlist namelist” pairs from the standard input.
    • 2

  2. ssh-keyscan is a utility for gathering the public ssh host keys of a number of hosts. It was designed to aid in building and verifying **ssh_known_hosts** files. ssh-keyscan provides a minimal interface suitable for use by shell and perl scripts.

    -f file
Read hosts or addrlist namelist pairs from this file, one per line. If - is supplied instead of a filename, ssh-keyscan will read hosts or addrlist namelist pairs from the standard input.


Input format: 
1.2.3.4,1.2.4.4 name.my.domain,name,n.my.domain,n,1.2.3.4,1.2.4.4

Output format for rsa1 keys:
host-or-namelist bits exponent modulus

Output format for rsa and dsa keys:
host-or-namelist keytype base64-encoded-key

Where keytype is either ''ssh-rsa'' or ''ssh-dss''.
/etc/ssh/ssh_known_hosts

    For Example: 

    Print the rsa host key for machine hostname:
$ ssh-keyscan hostname

Find all hosts from the file ssh_hosts which have new or different keys from those in the sorted file ssh_known_hosts:
$ ssh-keyscan -t rsa,dsa -f ssh_hosts | sort -u - ssh_known_hosts | diff ssh_known_hosts -
    • 0