Bug 2293

Summary:	ssh should have an option to automatically trust a local sshd's host key for a given set of names
Product:	Portable OpenSSH	Reporter:	Christoph Anton Mitterer <calestyo>
Component:	ssh	Assignee:	Assigned to nobody <unassigned-bugs>
Status:	CLOSED FIXED
Severity:	enhancement	CC:	djm
Priority:	P5
Version:	6.7p1
Hardware:	All
OS:	All
Bug Depends on:
Bug Blocks:	2782

Description Christoph Anton Mitterer 2014-10-15 08:11:55 AEDT

Hi.

I think it would be nice, if there was an option that lets ssh automatically trust hostkeys from a local sshd for a given set of names.

One could have e.g. the options:
1) LocalTrustedPublicHostKeyFiles
This would specify the locations of the files, where the public keys are found.
It could default to every file given in a HostKey directive in /etc/ssh/sshd_config.
But it should also allow a list of files to be given, just in case people run more than one sshd on their host, e.g. bound to different addresses and/or ports,... some in VMs or from "within" a chroot.


2) LocalTrustedHostNames
That should be a list of names for which only the keys from (1) will be considered valid.
Ideally it should default to anything that one can use to reach the local sshd's, which may include things like:
127.0.0.0/8
::1
localhost
hostname
hostname.fqdn
If possible also any local v4 and v6 addresses/prefixes, which is actually a bit tricky, since you may also have things like link local addresses/prefixes.

Even better it would do that only for addresses/names, where the local sshd really listens on.


Cheers,
Chris.

Comment 1 Christoph Anton Mitterer 2014-10-21 12:57:06 AEDT

I just saw, that NoHostAuthenticationForLocalhost=yes nearly already does what I've asked for.

It even works for other names than "localhost", e.g. "ip6-localhost" or "hostname" "hostname.fqdn", so I guess the check, whether a target is localhost, is based on whether it resolves to 127.0.0.0/8 or ::1 , right?

1) I think it would be nice to have it in the manpage, how it actually determines whether a host is local.


2) The only thing what would be missing from what I've asked for above, is that it would also work for addresses (and names resolving to these) that are bound to local interfaces, e.g. if my eth0 listens to 1.2.3.4, then it is accepted as well.

But I'm no longer sure myself, whether this would be so smart and secure.
The loopback device is defined to really go to the localhost only, but any other addresses my have black magic functionality (e.g. address rewriting).



I've reworked the documentation a bit:
https://github.com/openssh/openssh-portable/pull/10

Afterwards I think we can close this issue.

Comment 2 Damien Miller 2018-02-10 17:39:04 AEDT

I've committed 4f011daa4cad to clean up the NoHostAuthenticationForLocalhost explanation.

For hosts other than localhost, you can use "Match host" + UserKnownHostsFile=/dev/null + StrictHostKeyChecking=no

Comment 3 Damien Miller 2021-04-23 15:08:47 AEST

closing resolved bugs as of 8.6p1 release