Date: Thu, 15 May 2014 20:54:05 +0700 From: Victor Sudakov <vas@mpeks.tomsk.su> To: freebsd-questions@freebsd.org Subject: "VerifyHostKeyDNS yes" does not work as expected Message-ID: <20140515135405.GA52955@admin.sibptus.tomsk.ru>
next in thread | raw e-mail | index | archive | help
Dear Colleagues, I have "VerifyHostKeyDNS yes" set in ~/.ssh/config. Yet when I connect to a host, I get: $ ssh admin.sibptus.ru The authenticity of host 'admin.sibptus.ru (212.73.125.240)' can't be established. ECDSA key fingerprint is 83:ca:c0:af:42:5c:35:30:38:d7:78:e3:1d:c9:c2:3e. Matching host key fingerprint found in DNS. Are you sure you want to continue connecting (yes/no)? Why does ssh not implicitly trust the key published in DNS? Why does it ask me? The "sibptus.ru" zone is DNSSEC enabled. The local resolver is configured with "dnssec-validation auto". What else am I missing? Thanks for any ideas. Here is some debug: http://pastebin.com/q12R7RPH -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN sip:sudakov@sibptus.tomsk.ru
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20140515135405.GA52955>