Ubuntu
openssh package

Bug #483928
Comment #27

Comment 27 for bug 483928

Revision history for this message

In OpenSSH Portable Bugzilla #1213, Paul Townsend (aabatpurdue) wrote on 2011-03-04:

#27

(In reply to comment #24)
> Okay, I think I see what's going on here.
>
> When you click on the "attachment 2008 [details]" link, you're taken to a fancy
> side-by-side rendition of the diff. At the top, there are a series of
> links:
>
> View | Details | Raw Unified | Return to bug 1213 | Differences ...
>
> I was clicking on "Raw Unified," and got the broken patch. "View" goes
> to the URL you gave (which yields the correct patch). Confusing, isn't
> it?

Yes, it is indeed confusing. I've never used the exact path you used to get to the patch so I missed seeing the "bad" representation of it.

One of the things that I've observed in generating the "ssh_known_hosts" file is that it can end up having a quite variable keyset as it depends on ALL of the hosts ALWAYS being up (don't we wish). It's probably overkill but we generate the "hosts" file once an hour via a set of wrapper scripts. Included within the scripts is a database that contains the current keys for all hosts that are currently supposed to be active (previously acquired via these same scripts). This allows us two capabilities: 1) if there is no key returned for some host, the database can supply the last one and 2) it allows us to see if there have been any changes in the keys that might signify a security break.

A second part is a condensation of the keys via globbing. This assumes that a number of the hosts have the same key. The cluster nodes on our private networks are basically all cloned so we do get considerable condensation. Right now, for 4700+ hosts, the "hosts" file has 334 entries.

The core script is a highly modified variant of the GNU licensed script, "make_ssh_known_hosts.pl", that was in "ssh-1.0.0" (circa 1998). Note that's "ssh" not "openssh". My original came from "ssh-1.2.26". For some reason, it disappeared when the OpenSSH folks took over. For Linux boxes, it's still dependent on my bind 9 hack of `nslookup' as I haven't had time to modify it to use the current GNU `host'.

Would you be interested in anything like this?

(In reply to comment #24)
> Okay, I think I see what's going on here.
> 
> When you click on the "attachment 2008 [details]" link, you're taken to a fancy
> side-by-side rendition of the diff. At the top, there are a series of
> links:
> 
>     View | Details | Raw Unified | Return to bug 1213 | Differences ...
> 
> I was clicking on "Raw Unified," and got the broken patch. "View" goes
> to the URL you gave (which yields the correct patch). Confusing, isn't
> it?

Yes, it is indeed confusing.  I've never used the exact path you used to get to the patch so I missed seeing the "bad" representation of it.

One of the things that I've observed in generating the "ssh_known_hosts" file is that it can end up having a quite variable keyset as it depends on ALL of the hosts ALWAYS being up (don't we wish).  It's probably overkill but we generate the "hosts" file once an hour via a set of wrapper scripts.  Included within the scripts is a database that contains the current keys for all hosts that are currently supposed to be active (previously acquired via these same scripts).  This allows us two capabilities: 1) if there is no key returned for some host, the database can supply the last one and 2) it allows us to see if there have been any changes in the keys that might signify a security break.

A second part is a condensation of the keys via globbing. This assumes that a number of the hosts have the same key.  The cluster nodes on our private networks are basically all cloned so we do get considerable condensation.  Right now, for 4700+ hosts, the "hosts" file has 334 entries.

The core script is a highly modified variant of the GNU licensed script, "make_ssh_known_hosts.pl", that was in "ssh-1.0.0" (circa 1998).  Note that's "ssh" not "openssh".  My original came from "ssh-1.2.26".  For some reason, it disappeared when the OpenSSH folks took over.   For Linux boxes, it's still dependent on my bind 9 hack of `nslookup' as I haven't had time to modify it to use the current GNU `host'.

Would you be interested in anything like this?

Ubuntuopenssh package

Comment 27 for bug 483928

Ubuntu
openssh package