Re: sshfp records
On 23/01/13 16:59, Bob Proulx wrote:
> Brad Alexander wrote:
>> > Rookie mistake from messing with this too late at night. Apparently it
>> > only works with fully qualified domain names (therefore working more
>> > like dig than host):
> I wouldn't call that a rookie mistake. It seems like a missing
> feature that it doesn't map through to the dns name of the host. That
> just seems like it is missing some maturity in this brand new
> feature. (I haven't used the feature yet. Thank you for motivating
> me to look at it at least a little bit.)
>
It looks like that's been considered and possibly rejected, due to the
difficulty of remaining secure through the domain searches etc - you
have to rely on the order of the domains in resolv.conf to get the right
one, for starters.
This thread is interesting:
http://www.gossamer-threads.com/lists/openssh/dev/50638?do=post_view_threaded#50638
Richard
Reply to: