I'm stuck figuring out why ssh is unable to verify my SSHFP entries.
VerifyHostKeyDNS=yes is set in my
- The Zone is properly signed as verified with https://dnssec-analyzer.verisignlabs.com.
- SSHFP entries have been generated with
ssh-keygen -r myhostname
dig +dnssec myhostname.myzone.tldanswers with the proper RSIG entries and the
doflag set (tested with internal resolver (pfsense) and external (quad1, quad8, quad9))
I have tested everything with my Ubuntu 18.04 machine and can verify that it works (DNSSEC and SSH key verification), but my MacBook "thinks different"…
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:tV75nOBtVSASQEc4Ruf3iwBDAokvusd8BnLsfIWrzPQ debug1: found 6 insecure fingerprints in DNS debug1: matching host key fingerprint found in DNS The authenticity of host 'myhostname.myzone.tld (192.0.2.1)' can't be established. ECDSA key fingerprint is SHA256:tV75nOBtVSASQEc4Ruf3iwBDAokvusd8BnLsfIWrzPQ. Matching host key fingerprint found in DNS. Are you sure you want to continue connecting (yes/no)?
I had the same issue on my Ubuntu Machine as
systemd-resolved had DNSSEC not enabled.
mDNSResponder has no options at all.
Could it be that macOS Catalina has no DNSSEC support (yet?/enabled by default?)
- System: macOS Catalina 10.15.1
- Local Resolver: pfsense (unbound)
$ uname -a Darwin MacBook.home 19.0.0 Darwin Kernel Version 19.0.0: Thu Oct 17 16:17:18 CET 2019; root:xnu-6153.41.3~29/RELEASE_X86_64 x86_64 $ ssh -V OpenSSH_7.9p1, LibreSSL 2.7.3