Ubuntu
openssh package

  1. Bug #483928
  2. Comment #3

Comment 3 for bug 483928

Revision history for this message
In , Paul Wouters (paul-cypherpunks) wrote :

I was going to open a new bug report, but I think I am reporting the same bug as this one.

ssh-keyscan aborts when it encounters glue without the proper authoritative data. eg:

hostname.domain.com IN NS hostname.domain.com
hostname.domain.com IN A 1.2.3.4

Where hostname.domain.com is itself not running a namserver.
It is correct in not processing this entry, as the glue is non-authoritative data, and cannot be confirmed by the nameserver ot the child zone.
However, ssh-keyscan should just skip this entry, not abort.

I noticed this when writing ftp://ftp.xelerance.com/sshfp/ which is a python script that can use ssh-keyscan (or known_hosts files) to generate SSHFP records.