my-server
← Wiki Redirected from SSHFP

SSHFP record

A Secure Shell fingerprint record (abbreviated as SSHFP record) is a type of resource record in the Domain Name System (DNS) which identifies SSH keys that are associated with a host name. The acquisition of an SSHFP record needs to be secured with a mechanism such as DNSSEC for a chain of trust to be established.

Structure

: The name of the object to which the resource record belongs (optional)
: Time to live (in seconds). Validity of Resource Records (optional)
: Protocol group to which the resource record belongs (optional)
: Algorithm (0: reserved, 1: RSA, 2: DSA, 3: ECDSA, 4: Ed25519, 6: Ed448)
: Algorithm used to hash the public key (0: reserved, 1: SHA-1, 2: SHA-256)
: Hexadecimal representation of the hash result, as text

Example

In this example, the host with the domain name <code>host.example.com</code> uses a Ed25519 key with the SHA-256 fingerprint <code>123456789abcdef67890123456789abcdef67890</code>.

This output would be produced by a <code>ssh-keygen -r host.example.com.</code> command on the target server by reading the existing default SSH host key (Ed25519). In newer releases of the OpenSSH suite, <code>ssh-keyscan -D $HOSTNAME</code> can be used to produce a similar result, by connecting to the host over the network.

See also

References