RFC_6594_SSHFP_DNS_records#

__NOTOC__

#2642 Add support for enhanced SSHFP DNS records per RFC 6594

Overview#

IPA supports automatic update of SSHFP DNS records for managed hosts in the ipa-client-install script and in host-* commands. The support is currently limited to the original SSHFP specification from RFC 4255; SSHFP records generated by IPA contain SHA-1 fingerprints of RSA and DSS host keys.

Recently, RFC 6594 was released. It extends the original SSHFP specification with support for SHA-256 fingerprints and ECDSA host keys.

Add support for RFC 6594 SSHFP records to IPA, generate both SHA-1 and SHA-256 fingerprints for RSA, DSS and ECDSA host keys.

Use Cases#

Automatic generation of SSHFP DNS records on IPA client install:

| ``# ipa-client-install``
| ``Discovery was successful!``
| ``Hostname: host1.example.com``
| ``Realm: EXAMPLE.COM``
| ``DNS Domain: example.com``
| ``IPA Server: ipa.example.com``
| ``BaseDN: dc=example,dc=com``
| ``Continue to configure the system with these values? [no]: yes``
| ``User authorized to enroll computers: admin``
| ``Synchronizing time with KDC...``
| ``Password for admin@EXAMPLE.COM: ``
| ``Enrolled in IPA realm EXAMPLE.COM``
| ``Created /etc/ipa/default.conf``
| ``New SSSD config will be created``
| ``Configured /etc/sssd/sssd.conf``
| ``Configured /etc/krb5.conf for IPA realm EXAMPLE.COM``
| ``trying ``\ ```https://ipa.example.com/ipa/xml`` <https://ipa.example.com/ipa/xml>`__
| ``Hostname (host1.example.com) not found in DNS``
| ``DNS server record set to: host1.example.com -> 192.168.1.1``
| ``Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub``
| ``Adding SSH public key from /etc/ssh/ssh_host_dsa_key.pub``
| ``Forwarding 'host_mod' to server u'``\ ```https://ipa.example.com/ipa/xml`` <https://ipa.example.com/ipa/xml>`__\ ``'``
| ``SSSD enabled``
| ``Configured /etc/openldap/ldap.conf``
| ``NTP enabled``
| ``Configured /etc/ssh/ssh_config``
| ``Configured /etc/ssh/sshd_config``
| ``Client configuration complete.``

$ dig host1.example.com SSHFP +short
2 2 0E04A7E09D037934492108ED5590612416BE736AD1BCAEAE1EA4148E 80C956E2
2 1 F2A1353FF919AD785B6BD42B588F6236D1F67459
1 2 3E475EEAF17975C36EE1413DDD659275FDD19C97C2C74A3651BA12F7 52E12A18
1 1 A308B1B02A8B43CB5192E26FA50280F752BB3A14

Automatic generation of SSHFP DNS records when modifying a host:

$ ipa host-mod host2.example.com --updatedns --sshpubkey='ssh-rsa ``\ ``' --sshpubkey='ssh-dss ``\ ``' --sshpubkey='ecdsa-sha2-nistp256 ``\ ``'
---------------------------------------------
Modified host "host2.example.com"
---------------------------------------------
``  Host name: host2.example.com``
``  Principal name: host/host2.example.com@EXAMPLE.COM``
``  MAC address: 00:11:22:33:44:55``
``  SSH public key: ecdsa-sha2-nistp256 \ ``,
``                  ssh-dss \ ``,
``                  ssh-rsa ``
``  Keytab: True``
``  Managed by: host2.example.com``
``  SSH public key fingerprint: 6C:9F:07:51:63:36:32:8B:ED:CF:8C:4C:5F:F2:BF:AE (ecdsa-sha2-nistp256),``
``                              07:5D:0D:55:64:62:A3:FE:02:AE:FC:CD:F6:ED:E1:D9 (ssh-dss),``
``                              8C:C3:27:A8:40:9F:80:01:61:99:D2:25:55:A3:52:30 (ssh-rsa)``

$ dig host2.example.com SSHFP +short
2 2 43FFD792089442F08892CA753059FD8B7FA939E990CE4687A3D1FB75 E0B8F6DE
2 1 4C2C50EDEAE6BC6107A37EAE7A05694C15CFEC53
3 1 B1D733A262E29B44A4D8A9FAF4B3B9E78302D1DB
1 2 E5382308CFD60DE4F0ACF3BCB0366314EECFC71030A28AAF75280041 5FDF81A8
3 2 545055E921E94128AF6BFE68E6E2804333628F7808B8EAE10E297B11 3270862F
1 1 DA7A6687AE4B2C242E12A67DACDC67D26E374AD5

Design#

Implement support for SHA-256 fingerprints and ECDSA keys in SSHFP records in the ipapython.ssh module (add new method fingerprint_dns_sha256).

Extend ipa-client-install and the host plugin to add all types of SSHFP records to DNS.

Implementation#

N/A

Feature Managment#

N/A

Major configuration options and enablement#

N/A

Replication#

N/A

Updates and Upgrades#

N/A

Dependencies#

N/A

External Impact#

N/A

RFE Author#

Jan Cholasta

RFC_6594_SSHFP_DNS_records

Contents