I need to setup SSHFP records in the DNS for my host. I have done some searching but I haven't found any good example.What are SSHFP records?What does SSHFP records look like?How do I create SSHFP records?
How do I generate SSHFP records?
ssh;dns;openssl
What are SSHFP records?SSHFP RR records are DNS records that contain fingerprints for public keys used for SSH. They're mostly used with DNSSEC enabled domains. When a SSH client connects to a server it checks the corresponding SSHFP record. If the records fingerprint matches the servers, the server is legit and it's safe to connect.What does SSHFP records look like?SSHFP records consist of three things:AlgorithmFingerprint typeFingerprint (in hex)AlgorithmThere are four different algorithms defined in SSHFP as of 2015. Each algorithm is represented by an integer. The algorithms are:1 - RSA2 - DSA3 - ECDSA4 - Ed25519Fingerprint typeTwo fingerprint types are defined in SSHFP as of 2012. Each fingerprint type is represented by an integer. These are:1 - SHA-12 - SHA-256How do I generate SSHFP records?You can use ssh-keygen to generate the records using the -r parameter, followed by the hostname (which does not effect the fingerprints so you can specify whatever you like instead)ExampleUsing ssh-keygen and CentOS 6:[root@localhost ~]# ssh-keygen -r my.domain.commy.domain.com IN SSHFP 1 1 450c7d19d5da9a3a5b7c19992d1fbde15d8dad34my.domain.com IN SSHFP 2 1 72d30d211ce8c464de2811e534de23b9be9b4dc4NoteSometimes ssh-keygen will ask for the location of the public certificate. If it asks, you will have to run ssh-keygen multiple times and every time specify a different certificate to make sure that you generate all necessary SSHFP records. Your public keys are usually located in /etc/ssh.