'\" te
.\" Copyright (c) 2004, Sun Microsystems, Inc. All Rights Reserved.
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH SSH-KEYSCAN 1 "Jul 24, 2004"
.SH NAME
ssh-keyscan \- gather public ssh host keys of a number of hosts
.SH SYNOPSIS
.LP
.nf
\fBssh-keyscan\fR [\fB-v46\fR] [\fB-p\fR \fIport\fR] [\fB-T\fR \fItimeout\fR] [\fB-t\fR \fItype\fR]
     [\fB-f\fR \fIfile\fR] [\fB-\fR] [\fIhost\fR... | \fIaddrlist\fR \fInamelist\fR] [...]
.fi

.SH DESCRIPTION
.sp
.LP
\fBssh-keyscan\fR is a utility for gathering the public ssh host keys of a
number of hosts. It was designed to aid in building and verifying
\fBssh_known_hosts\fR files. \fBssh-keyscan\fR provides a minimal interface
suitable for use by shell and perl scripts. The output of \fBssh-keyscan\fR is
directed to standard output.
.sp
.LP
\fBssh-keyscan\fR uses non-blocking socket I/O to contact as many hosts as
possible in parallel, so it is very efficient. The keys from a domain of 1,000
hosts can be collected in tens of seconds, even when some of those hosts are
down or do not run ssh. For scanning, one does not need login access to the
machines that are being scanned, nor does the scanning process involve any
encryption.
.SS "File Format"
.sp
.LP
Input format:
.sp
.in +2
.nf
1.2.3.4,1.2.4.4
\fIname.my.domain,name,n.my.domain,n,\fR1.2.3.4,1.2.4.4
.fi
.in -2
.sp

.sp
.LP
Output format for \fBrsa1\fR keys:
.sp
.in +2
.nf
\fIhost-or-namelist bits exponent modulus\fR
.fi
.in -2
.sp

.sp
.LP
Output format for \fBrsa\fR and \fBdsa\fR keys, where \fIkeytype\fR is either
\fBssh-rsa\fR or `\fBssh-dsa\fR:
.sp
.in +2
.nf
\fIhost-or-namelist keytype base64-encoded-key\fR
.fi
.in -2
.sp

.SH OPTIONS
.sp
.LP
The following options are supported:
.sp
.ne 2
.na
\fB\fB-f\fR \fIfilename\fR\fR
.ad
.RS 28n
Read hosts or addrlist namelist pairs from this file, one per line. If you
specity - instead of a filename, \fBssh-keyscan\fR reads hosts or addrlist
namelist pairs from the standard input.
.RE

.sp
.ne 2
.na
\fB\fB-p\fR \fIport\fR\fR
.ad
.RS 28n
Port to connect to on the remote host.
.RE

.sp
.ne 2
.na
\fB\fB-T\fR \fItimeout\fR\fR
.ad
.RS 28n
Set the timeout for connection attempts. If \fItimeout\fR seconds have elapsed
since a connection was initiated to a host or since the last time anything was
read from that host, the connection is closed and the host in question is
considered unavailable. The default is for \fItimeout\fR is 5 seconds.
.RE

.sp
.ne 2
.na
\fB\fB-t\fR \fItype\fR\fR
.ad
.RS 28n
Specify the type of the key to fetch from the scanned hosts. The possible
values for \fItype\fR are \fBrsa1\fR for protocol version 1 and \fBrsa\fR or
\fBdsa\fR for protocol version 2. Specify multiple values by separating them
with commas. The default is \fBrsa1\fR.
.RE

.sp
.ne 2
.na
\fB\fB-v\fR\fR
.ad
.RS 28n
Specify verbose mode. Print debugging messages about progress.
.RE

.sp
.ne 2
.na
\fB\fB-4\fR\fR
.ad
.RS 28n
Force to use IPv4 addresses only.
.RE

.sp
.ne 2
.na
\fB\fB-6\fR\fR
.ad
.RS 28n
Forces to use IPv6 addresses only.
.RE

.SH SECURITY
.sp
.LP
If a \fBssh_known_hosts\fR file is constructed using \fBssh-keyscan\fR without
verifying the keys, users are vulnerable to man-in-the-middle attacks. If the
security model allows such a risk, \fBssh-keyscan\fR can help in the detection
of tampered keyfiles or man-in-the-middle attacks which have begun after the
\fBssh_known_hosts\fR file was created.
.SH EXAMPLES
.LP
\fBExample 1 \fRPrinting the \fBrsa1\fR Host Key
.sp
.LP
The following example prints the \fBrsa1\fR host key for machine
\fBhostname\fR:

.sp
.in +2
.nf
$ ssh-keyscan hostname
.fi
.in -2
.sp

.LP
\fBExample 2 \fRFinding All Hosts
.sp
.LP
The following commands finds all hosts from the file \fBssh_hosts\fR which have
new or different keys from those in the sorted file \fBssh_known_hosts\fR:

.sp
.in +2
.nf
$ ssh-keyscan -t rsa,dsa -f ssh_hosts | \e
     sort -u - ssh_known_hosts | diff ssh_known_hosts -
.fi
.in -2
.sp

.SH FILES
.sp
.ne 2
.na
\fB\fB/etc/ssh_known_hosts\fR \fR
.ad
.RS 25n

.RE

.SH EXIT STATUS
.sp
.LP
The following exit values are returned:
.sp
.ne 2
.na
\fB\fB0\fR \fR
.ad
.RS 6n
No usage errors. \fBssh-keyscan\fR might or might not have succeeded or failed
to scan one, more or all of the given hosts.
.RE

.sp
.ne 2
.na
\fB\fB1\fR\fR
.ad
.RS 6n
Usage error.
.RE

.SH ATTRIBUTES
.sp
.LP
See \fBattributes\fR(5) for descriptions of the following attributes:
.sp

.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE	ATTRIBUTE VALUE
_
Interface Stability	Evolving
.TE

.SH SEE ALSO
.sp
.LP
\fBssh\fR(1), \fBsshd\fR(1M), \fBattributes\fR(5)
.SH AUTHORS
.sp
.LP
David Mazieres wrote the initial version, and Wayne Davison added suppport for
protocol version 2.
.SH BUGS
.sp
.LP
\fBssh\(emkeyscan\fR generates
.sp
.in +2
.nf
Connection closed by remote host
.fi
.in -2
.sp

.sp
.LP
messages on the consoles of all machines it scans if the server is older than
version 2.9. This is because \fBssh-keyscan\fR opens a connection to the
\fBssh\fR port, reads the public key, and drops the connection as soon as it
gets the key.