Skip to content

docs: keep only key lines from ssh-keyscan in the known_hosts steps #163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
groupsky merged 2 commits into from
Nov 9, 2026
Merged

docs: keep only key lines from ssh-keyscan in the known_hosts steps #163

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d0d747a
docs: keep only key lines from ssh-keyscan, and count them in step 3
groupsky Nov 9, 2026
a48e971
docs: note the commit message of 1e84d0c, and accept sk- keys in the …
groupsky Nov 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 28 additions & 2 deletions docs/setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1003,11 +1003,20 @@ of an agent machine: the agent can change that file.

```sh
ssh-keyscan -t ed25519,ecdsa,rsa web-1.example.com 2>/dev/null |
awk '{print "web-1", $2, $3}' >> /run/nodkey-setup/known_hosts
awk '$1 !~ /^#/ {print "web-1", $2, $3}' >> /run/nodkey-setup/known_hosts
ssh-keyscan -t ed25519,ecdsa,rsa -p 2222 web-2.example.com 2>/dev/null |
awk '{print "web-2", $2, $3}' >> /run/nodkey-setup/known_hosts
awk '$1 !~ /^#/ {print "web-2", $2, $3}' >> /run/nodkey-setup/known_hosts
```

`ssh-keyscan` also prints a comment line for each host, such as
`# web-1.example.com:22 SSH-2.0-OpenSSH_9.8`. Since OpenSSH 9.8 it
prints these lines on stdout, not on stderr
([commit 1e84d0c](https://github.com/openssh/openssh-portable/commit/1e84d0cf40e94ae3a77d6a7ca8c036d8e3d55a40)),
so `2>/dev/null` does not remove them. (The message of that commit
says the opposite, but its code moves the lines to stdout.) The `awk` drops every line
that starts with `#`, so the file gets only key lines with each
version.

3. Show the fingerprints of the fetched keys, and compare them with the
list from step 1. Each one must be the same. If one differs, stop:
something between the broker host and that host may change the keys.
Expand All @@ -1016,6 +1025,23 @@ of an agent machine: the agent can change that file.
ssh-keygen -lf /run/nodkey-setup/known_hosts
```

`ssh-keygen -lf` skips a line that is not a key, and says nothing.
So also check that the file has one line for each fingerprint. The
two numbers must be the same:

```sh
wc -l < /run/nodkey-setup/known_hosts
ssh-keygen -lf /run/nodkey-setup/known_hosts | wc -l
```

If the first number is bigger, a line is not a key. This command
shows each such line with its number. Remove them, and run the check
again:

```sh
awk '$2 !~ /^(ssh-|ecdsa-|sk-)/ {print NR ": " $0}' /run/nodkey-setup/known_hosts
```

4. Install the file:

```sh
Expand Down
Loading