diff options
Diffstat (limited to 'ssh-keyscan.0')
-rw-r--r-- | ssh-keyscan.0 | 93 |
1 files changed, 46 insertions, 47 deletions
diff --git a/ssh-keyscan.0 b/ssh-keyscan.0 index 05742bf66..3c3067cc9 100644 --- a/ssh-keyscan.0 +++ b/ssh-keyscan.0 | |||
@@ -1,101 +1,100 @@ | |||
1 | SSH-KEYSCAN(1) System General Commands Manual SSH-KEYSCAN(1) | 1 | SSHM-bM-^@M-^PKEYSCAN(1) BSD General Commands Manual SSHM-bM-^@M-^PKEYSCAN(1) |
2 | 2 | ||
3 | NAME | 3 | ^[[1mNAME^[[0m |
4 | ssh-keyscan - gather ssh public keys | 4 | ^[[1msshM-bM-^@M-^Pkeyscan ^[[22mM-bMM-^R gather ssh public keys |
5 | 5 | ||
6 | SYNOPSIS | 6 | ^[[1mSYNOPSIS^[[0m |
7 | ssh-keyscan [-v46] [-p port] [-T timeout] [-t type] [-f file] | 7 | ^[[1msshM-bM-^@M-^Pkeyscan ^[[22m[^[[1mM-bMM-^Rv46^[[22m] [^[[1mM-bMM-^Rp ^[[4m^[[22mport^[[24m] [^[[1mM-bMM-^RT ^[[4m^[[22mtimeout^[[24m] [^[[1mM-bMM-^Rt ^[[4m^[[22mtype^[[24m] [^[[1mM-bMM-^Rf ^[[4m^[[22mfile^[[24m] |
8 | [host | addrlist namelist] [...] | 8 | [^[[4mhost^[[24m | ^[[4maddrlist^[[24m ^[[4mnamelist^[[24m] [^[[4m...^[[24m] |
9 | 9 | ||
10 | DESCRIPTION | 10 | ^[[1mDESCRIPTION^[[0m |
11 | ssh-keyscan is a utility for gathering the public ssh host keys of a numM-- | 11 | ^[[1msshM-bM-^@M-^Pkeyscan ^[[22mis a utility for gathering the public ssh host keys of a numM-bM-^@M-^P |
12 | ber of hosts. It was designed to aid in building and verifying | 12 | ber of hosts. It was designed to aid in building and verifying |
13 | ssh_known_hosts files. ssh-keyscan provides a minimal interface suitable | 13 | ^[[4mssh_known_hosts^[[24m files. ^[[1msshM-bM-^@M-^Pkeyscan ^[[22mprovides a minimal interface suitable |
14 | for use by shell and perl scripts. | 14 | for use by shell and perl scripts. |
15 | 15 | ||
16 | ssh-keyscan uses non-blocking socket I/O to contact as many hosts as posM-- | 16 | ^[[1msshM-bM-^@M-^Pkeyscan ^[[22muses nonM-bM-^@M-^Pblocking socket I/O to contact as many hosts as posM-bM-^@M-^P |
17 | sible in parallel, so it is very efficient. The keys from a domain of | 17 | sible in parallel, so it is very efficient. The keys from a domain of |
18 | 1,000 hosts can be collected in tens of seconds, even when some of those | 18 | 1,000 hosts can be collected in tens of seconds, even when some of those |
19 | hosts are down or do not run ssh. For scanning, one does not need login | 19 | hosts are down or do not run ssh. For scanning, one does not need login |
20 | access to the machines that are being scanned, nor does the scanning proM-- | 20 | access to the machines that are being scanned, nor does the scanning proM-bM-^@M-^P |
21 | cess involve any encryption. | 21 | cess involve any encryption. |
22 | 22 | ||
23 | The options are as follows: | 23 | The options are as follows: |
24 | 24 | ||
25 | -p port | 25 | ^[[1mM-bMM-^Rp ^[[4m^[[22mport^[[0m |
26 | Port to connect to on the remote host. | 26 | Port to connect to on the remote host. |
27 | 27 | ||
28 | -T timeout | 28 | ^[[1mM-bMM-^RT ^[[4m^[[22mtimeout^[[0m |
29 | Set the timeout for connection attempts. If timeout seconds have | 29 | Set the timeout for connection attempts. If ^[[4mtimeout^[[24m seconds have |
30 | elapsed since a connection was initiated to a host or since the | 30 | elapsed since a connection was initiated to a host or since the |
31 | last time anything was read from that host, then the connection | 31 | last time anything was read from that host, then the connection |
32 | is closed and the host in question considered unavailable. | 32 | is closed and the host in question considered unavailable. |
33 | Default is 5 seconds. | 33 | Default is 5 seconds. |
34 | 34 | ||
35 | -t type | 35 | ^[[1mM-bMM-^Rt ^[[4m^[[22mtype^[[0m |
36 | Specifies the type of the key to fetch from the scanned hosts. | 36 | Specifies the type of the key to fetch from the scanned hosts. |
37 | The possible values are ``rsa1'' for protocol version 1 and | 37 | The possible values are M-bM-^@M-^\rsa1M-bM-^@M-^] for protocol version 1 and M-bM-^@M-^\rsaM-bM-^@M-^] |
38 | ``rsa'' or ``dsa'' for protocol version 2. Multiple values may | 38 | or M-bM-^@M-^\dsaM-bM-^@M-^] for protocol version 2. Multiple values may be speciM-bM-^@M-^P |
39 | be specified by separating them with commas. The default is | 39 | fied by separating them with commas. The default is M-bM-^@M-^\rsa1M-bM-^@M-^]. |
40 | ``rsa1''. | ||
41 | 40 | ||
42 | -f filename | 41 | ^[[1mM-bMM-^Rf ^[[4m^[[22mfilename^[[0m |
43 | Read hosts or addrlist namelist pairs from this file, one per | 42 | Read hosts or ^[[4maddrlist^[[24m ^[[4mnamelist^[[24m pairs from this file, one per |
44 | line. If - is supplied instead of a filename, ssh-keyscan will | 43 | line. If ^[[4mM-bM-^@M-^P^[[24m is supplied instead of a filename, ^[[1msshM-bM-^@M-^Pkeyscan ^[[22mwill |
45 | read hosts or addrlist namelist pairs from the standard input. | 44 | read hosts or ^[[4maddrlist^[[24m ^[[4mnamelist^[[24m pairs from the standard input. |
46 | 45 | ||
47 | -v Verbose mode. Causes ssh-keyscan to print debugging messages | 46 | ^[[1mM-bMM-^Rv ^[[22mVerbose mode. Causes ^[[1msshM-bM-^@M-^Pkeyscan ^[[22mto print debugging messages |
48 | about its progress. | 47 | about its progress. |
49 | 48 | ||
50 | -4 Forces ssh-keyscan to use IPv4 addresses only. | 49 | ^[[1mM-bMM-^R4 ^[[22mForces ^[[1msshM-bM-^@M-^Pkeyscan ^[[22mto use IPv4 addresses only. |
51 | 50 | ||
52 | -6 Forces ssh-keyscan to use IPv6 addresses only. | 51 | ^[[1mM-bMM-^R6 ^[[22mForces ^[[1msshM-bM-^@M-^Pkeyscan ^[[22mto use IPv6 addresses only. |
53 | 52 | ||
54 | SECURITY | 53 | ^[[1mSECURITY^[[0m |
55 | If a ssh_known_hosts file is constructed using ssh-keyscan without veriM-- | 54 | If a ssh_known_hosts file is constructed using ^[[1msshM-bM-^@M-^Pkeyscan ^[[22mwithout veriM-bM-^@M-^P |
56 | fying the keys, users will be vulnerable to attacks. On the other hand, | 55 | fying the keys, users will be vulnerable to attacks. On the other hand, |
57 | if the security model allows such a risk, ssh-keyscan can help in the | 56 | if the security model allows such a risk, ^[[1msshM-bM-^@M-^Pkeyscan ^[[22mcan help in the |
58 | detection of tampered keyfiles or man in the middle attacks which have | 57 | detection of tampered keyfiles or man in the middle attacks which have |
59 | begun after the ssh_known_hosts file was created. | 58 | begun after the ssh_known_hosts file was created. |
60 | 59 | ||
61 | EXAMPLES | 60 | ^[[1mEXAMPLES^[[0m |
62 | Print the rsa1 host key for machine hostname: | 61 | Print the ^[[4mrsa1^[[24m host key for machine ^[[4mhostname^[[24m: |
63 | 62 | ||
64 | $ ssh-keyscan hostname | 63 | $ sshM-bM-^@M-^Pkeyscan hostname |
65 | 64 | ||
66 | Find all hosts from the file ssh_hosts which have new or different keys | 65 | Find all hosts from the file ^[[4mssh_hosts^[[24m which have new or different keys |
67 | from those in the sorted file ssh_known_hosts: | 66 | from those in the sorted file ^[[4mssh_known_hosts^[[24m: |
68 | 67 | ||
69 | $ ssh-keyscan -t rsa,dsa -f ssh_hosts | \ | 68 | $ sshM-bM-^@M-^Pkeyscan M-bM-^@M-^Pt rsa,dsa M-bM-^@M-^Pf ssh_hosts | \ |
70 | sort -u - ssh_known_hosts | diff ssh_known_hosts - | 69 | sort M-bM-^@M-^Pu M-bM-^@M-^P ssh_known_hosts | diff ssh_known_hosts M-bM-^@M-^P |
71 | 70 | ||
72 | FILES | 71 | ^[[1mFILES^[[0m |
73 | Input format: | 72 | ^[[4mInput^[[24m ^[[4mformat:^[[0m |
74 | 73 | ||
75 | 1.2.3.4,1.2.4.4 name.my.domain,name,n.my.domain,n,1.2.3.4,1.2.4.4 | 74 | 1.2.3.4,1.2.4.4 name.my.domain,name,n.my.domain,n,1.2.3.4,1.2.4.4 |
76 | 75 | ||
77 | Output format for rsa1 keys: | 76 | ^[[4mOutput^[[24m ^[[4mformat^[[24m ^[[4mfor^[[24m ^[[4mrsa1^[[24m ^[[4mkeys:^[[0m |
78 | 77 | ||
79 | host-or-namelist bits exponent modulus | 78 | hostM-bM-^@M-^PorM-bM-^@M-^Pnamelist bits exponent modulus |
80 | 79 | ||
81 | Output format for rsa and dsa keys: | 80 | ^[[4mOutput^[[24m ^[[4mformat^[[24m ^[[4mfor^[[24m ^[[4mrsa^[[24m ^[[4mand^[[24m ^[[4mdsa^[[24m ^[[4mkeys:^[[0m |
82 | 81 | ||
83 | host-or-namelist keytype base64-encoded-key | 82 | hostM-bM-^@M-^PorM-bM-^@M-^Pnamelist keytype base64M-bM-^@M-^PencodedM-bM-^@M-^Pkey |
84 | 83 | ||
85 | Where keytype is either ``ssh-rsa'' or ``ssh-dsa''. | 84 | Where ^[[4mkeytype^[[24m is either M-bM-^@M-^\sshM-bM-^@M-^PrsaM-bM-^@M-^] or M-bM-^@M-^\sshM-bM-^@M-^PdsaM-bM-^@M-^]. |
86 | 85 | ||
87 | /etc/ssh/ssh_known_hosts | 86 | ^[[4m/etc/ssh/ssh_known_hosts^[[0m |
88 | 87 | ||
89 | BUGS | 88 | ^[[1mBUGS^[[0m |
90 | It generates "Connection closed by remote host" messages on the consoles | 89 | It generates "Connection closed by remote host" messages on the consoles |
91 | of all the machines it scans if the server is older than version 2.9. | 90 | of all the machines it scans if the server is older than version 2.9. |
92 | This is because it opens a connection to the ssh port, reads the public | 91 | This is because it opens a connection to the ssh port, reads the public |
93 | key, and drops the connection as soon as it gets the key. | 92 | key, and drops the connection as soon as it gets the key. |
94 | 93 | ||
95 | SEE ALSO | 94 | ^[[1mSEE ALSO^[[0m |
96 | ssh(1), sshd(8) | 95 | ssh(1), sshd(8) |
97 | 96 | ||
98 | AUTHORS | 97 | ^[[1mAUTHORS^[[0m |
99 | David Mazieres <dm@lcs.mit.edu> wrote the initial version, and Wayne | 98 | David Mazieres <dm@lcs.mit.edu> wrote the initial version, and Wayne |
100 | Davison <wayned@users.sourceforge.net> added support for protocol version | 99 | Davison <wayned@users.sourceforge.net> added support for protocol version |
101 | 2. | 100 | 2. |