diff options
| author | jym <jym@NetBSD.org> | 2013-10-06 17:25:34 +0000 |
|---|---|---|
| committer | jym <jym@NetBSD.org> | 2013-10-06 17:25:34 +0000 |
| commit | 7e26739a1589178e5f0a88b10b8fbf11ba09ac38 (patch) | |
| tree | 046c3e146b8b5e499ac0deb5edde7ca59c0c8d1f /sys/dev/microcode/typhoon | |
| parent | 987b7e938712b90f06ed7d9b9e5936a318717b41 (diff) | |
Enable VerifyHostKeyDNS (SSHFP records verification) from DNS for hosts
under NetBSD.org domain.
Multiple TNF hosts have an up-to-date SSHFP record inside the DNS.
This offers a second channel verification for host key fingerprints
(weaker than known_hosts, but spoofing a host on first connect would
also require DNS forgery).
This can provide a trusted second channel (like DANE TLSA records) once
DNSSEC gets more widely used, but for now it is purely informational.
No regression expected, except that the ssh client will print a message
upon first connect to confirm/infirm that it got a correct SSHFP record
from DNS.
Only done for NetBSD.org domain, SSHFP are sadly more an exception than
the rule.
Notified on netbsd-users@, no objection after a week -- committed.
Diffstat (limited to 'sys/dev/microcode/typhoon')
0 files changed, 0 insertions, 0 deletions
