SSH 的 StrictHostKeyChecking=accept-new
source link: https://blog.gslin.org/archives/2022/01/14/10506/ssh-%e7%9a%84-stricthostkeycheckingaccept-new/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
SSH 的 StrictHostKeyChecking=accept-new
OpenSSH 在連到新的 host 時會跳出 key fingerprint 的資訊讓使用者確認，有時候為了自動化會用 StrictHostKeyChecking=no 避開，在 Lobsters Daily 上則看到了新的選項可以用，StrictHostKeyChecking=accept-new：
Reading manuals is extremely helpful.
I discovered the "accept-new" option for ssh strict host key checking and now I can delete my buggy code for manually populating known_hosts. 😅
Does exactly what it says. If the host key not in known_hosts, add it. Fail otherwise. pic.twitter.com/9xsbsMcpur
— Anton Medvedev (@antonmedv) January 11, 2022
就如同選項的名字所描述的，查了一下 OpenSSH Release Notes 可以看到這是在 OpenSSH 7.5 導入的參數，是在 March 20, 2017 引入的：
* ssh(1): expand the StrictHostKeyChecking option with two new settings. The first "accept-new" will automatically accept hitherto-unseen keys but will refuse connections for changed or invalid hostkeys. This is a safer subset of the current behaviour of StrictHostKeyChecking=no. The second setting "off", is a synonym for the current behaviour of StrictHostKeyChecking=no: accept new host keys, and continue connection for hosts with incorrect hostkeys. A future release will change the meaning of StrictHostKeyChecking=no to the behaviour of "accept-new". bz#2400
對於一些自動化的流程應該夠用了，不需要到用 no 完全關掉。
翻了「Ubuntu – Package Search Results -- openssh-client」可以看到 18.04 之後都是 7.5 之後的版本了，支援度應該是沒什麼太大問題...
Related
SSH 的 SSHFP record
很久前看過 SSHFPT record，當時支援度不高就忘記了... 剛剛在 Cloudflare 的這篇「Additional Record Types Available with Cloudflare DNS」看到發現 OpenSSH 很久前就有支援了... 用法是 VerifyHostKeyDNS 這個 option，像是 ssh -o "VerifyHostKeyDNS=yes" -o "StrictHostKeyChecking=yes" hostname 這樣的指令，對於 ~/.ssh/known_hosts 裡沒有的機器，在第一次連線的時候會去查 DNS record，如果沒有查到的話就會中斷。 產生 SSHFP record 的方式則是可以參考「How do I generate SSHFP records?」這篇，也就是直接用 sshkey-gen -r [hostname]，程式就會去讀 /etc/ssh/ 下的資料產生了。
August 7, 2018In "Computer"
OpenSSH 8.4 預設停用 ssh-rsa
前幾天 OpenSSH 8.4 釋出了：「Announce: OpenSSH 8.4 released」。 比較重要的改變是 ssh-rsa 預設變成停用，因為是使用 SHA-1 演算法的關係： It is now possible[1] to perform chosen-prefix attacks against the SHA-1 algorithm for less than USD$50K. For this reason, we will be disabling the "ssh-rsa" public key signature algorithm by default in a near-future release. 官方給了三個方案： The RFC8332…
October 3, 2020In "Computer"
OpenSSH 的三個進階用法：CA 架構、透過 Jump Server 連線、2FA
在「How to SSH Properly」這篇裡面講了三個 OpenSSH 的進階用法：CA 架構、透過 Jump Server 連線，以及 2FA 的設定。 之前蠻常看到使用 -o StrictHostKeyChecking=off 關閉檢查，但 OpenSSH 有支援 CA 架構，可以先產生出 Root CA，然後對 Host 的 Public Key 簽名，在連線的時候就可以確保連線沒有被調包 (通常是 MITM)，但得設計一套機制，自動化機器生出來後的步驟。 另外一個可能的方式是 SSHFP，搭配 DNSSEC 也可以確認連線沒有被調包，不過這又牽扯到 DNS 的部份... 第二個提到的是 Jump Server (Bastion host)，之前的作法是用 -A 把 authentication agent 帶過去再連進去，這邊則是教你怎麼下指令直接連線，而不需要先連到 Jump Server (但實際上底層是透過 Jump Server)。…
April 6, 2020In "Computer"
Leave a Reply Cancel reply
Your email address will not be published. Required fields are marked *
Comment
Name *
Email *
Website
Notify me of follow-up comments by email.
Notify me of new posts by email.
To respond on your own website, enter the URL of your response which should contain a link to this post's permalink URL. Your response will then appear (possibly after moderation) on this page. Want to update or remove your response? Update or delete your post and re-enter your post's URL again. (Learn More)
Post navigation
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK