ssh-keyscan(1)

1ssh-keyscan(1)                   User Commands                  ssh-keyscan(1)
2
3
4

NAME

6       ssh-keyscan - gather public ssh host keys of a number of hosts
7

SYNOPSIS

9       ssh-keyscan [-v46] [-p port] [-T timeout] [-t type]
10            [-f file] [-] [host... | addrlist namelist] [...]
11
12

DESCRIPTION

14       ssh-keyscan  is  a  utility for gathering the public ssh host keys of a
15       number of hosts. It was designed  to  aid  in  building  and  verifying
16       ssh_known_hosts  files.  ssh-keyscan provides a minimal interface suit‐
17       able for use by shell and perl scripts. The output  of  ssh-keyscan  is
18       directed to standard output.
19
20
21       ssh-keyscan  uses  non-blocking  socket I/O to contact as many hosts as
22       possible in parallel, so it is very efficient. The keys from  a  domain
23       of  1,000  hosts can be collected in tens of seconds, even when some of
24       those hosts are down or do not run ssh. For scanning, one does not need
25       login access to the machines that are being scanned, nor does the scan‐
26       ning process involve any encryption.
27
28   File Format
29       Input format:
30
31         1.2.3.4,1.2.4.4
32         name.my.domain,name,n.my.domain,n,1.2.3.4,1.2.4.4
33
34
35
36
37       Output format for rsa1 keys:
38
39         host-or-namelist bits exponent modulus
40
41
42
43
44       Output format for rsa and dsa keys, where keytype is either ssh-rsa  or
45       `ssh-dsa:
46
47         host-or-namelist keytype base64-encoded-key
48
49
50

OPTIONS

52       The following options are supported:
53
54       -f filename                 Read  hosts or addrlist namelist pairs from
55                                   this file, one per line. If you  specity  -
56                                   instead  of  a  filename, ssh-keyscan reads
57                                   hosts or addrlist namelist pairs  from  the
58                                   standard input.
59
60
61       -p port                     Port to connect to on the remote host.
62
63
64       -T timeout                  Set the timeout for connection attempts. If
65                                   timeout seconds have elapsed since  a  con‐
66                                   nection  was  initiated  to a host or since
67                                   the last time anything was read  from  that
68                                   host, the connection is closed and the host
69                                   in question is considered unavailable.  The
70                                   default is for timeout is 5 seconds.
71
72
73       -t type                     Specify  the  type of the key to fetch from
74                                   the scanned hosts. The possible values  for
75                                   type  are  rsa1  for protocol version 1 and
76                                   rsa or dsa for protocol version 2.  Specify
77                                   multiple  values  by  separating  them with
78                                   commas. The default is rsa1.
79
80
81       -v                          Specify verbose mode. Print debugging  mes‐
82                                   sages about progress.
83
84
85       -4                          Force to use IPv4 addresses only.
86
87
88       -6                          Forces to use IPv6 addresses only.
89
90

SECURITY

92       If a ssh_known_hosts file is constructed using ssh-keyscan without ver‐
93       ifying the keys, users are vulnerable to man-in-the-middle attacks.  If
94       the  security  model  allows  such  a risk, ssh-keyscan can help in the
95       detection of tampered keyfiles or man-in-the-middle attacks which  have
96       begun after the ssh_known_hosts file was created.
97

EXAMPLES

99       Example 1 Printing the rsa1 Host Key
100
101
102       The following example prints the rsa1 host key for machine hostname:
103
104
105         $ ssh-keyscan hostname
106
107
108
109       Example 2 Finding All Hosts
110
111
112       The  following  commands  finds all hosts from the file ssh_hosts which
113       have  new  or  different  keys  from   those   in   the   sorted   file
114       ssh_known_hosts:
115
116
117         $ ssh-keyscan -t rsa,dsa -f ssh_hosts | \
118              sort -u - ssh_known_hosts | diff ssh_known_hosts -
119
120
121

FILES

123       /etc/ssh_known_hosts
124
125

EXIT STATUS

127       The following exit values are returned:
128
129       0     No usage errors. ssh-keyscan might or might not have succeeded or
130             failed to scan one, more or all of the given hosts.
131
132
133       1     Usage error.
134
135

ATTRIBUTES

137       See attributes(5) for descriptions of the following attributes:
138
139
140
141
142       ┌─────────────────────────────┬─────────────────────────────┐
143       │      ATTRIBUTE TYPE         │      ATTRIBUTE VALUE        │
144       ├─────────────────────────────┼─────────────────────────────┤
145       │Availability                 │SUNWsshu                     │
146       ├─────────────────────────────┼─────────────────────────────┤
147       │Interface Stability          │Evolving                     │
148       └─────────────────────────────┴─────────────────────────────┘
149

AUTHORS

154       David Mazieres wrote the initial version, and Wayne Davison added supp‐
155       port for protocol version 2.
156

BUGS

158       ssh—keyscan generates
159
160         Connection closed by remote host
161
162
163
164
165       messages  on  the  consoles  of  all machines it scans if the server is
166       older than version 2.9. This is because ssh-keyscan opens a  connection
167       to the ssh port, reads the public key, and drops the connection as soon
168       as it gets the key.
169
170
171
172SunOS 5.11                        24 Jul 2004                   ssh-keyscan(1)