#9660 support SSH hostkey format
Opened by abbra. Modified

IPA host object allows to load public SSH key into it. This key will then be queried by SSSD helper to return as a known ssh host key. However, the format validator IPA uses only accepts public SSH keys used for authentication, not known ssh host keys. The latter have the same fields and prefixed by the list of hostname patterns.

See man page for sshd(8), SSH_KNOWN_HOSTS FILE FORMAT section:

        Each line in these files contains the following fields: 
        marker (optional), hostnames, keytype, base64-encoded key, comment.
        The fields are separated by spaces.
        Hostnames is a comma-separated list of patterns (* and ? act
        as wildcards); each pattern in turn is matched against the host
        name.  When sshd is authenticating a client, such as when using
        HostbasedAuthentication, this  will  be  the  canonical  client
        host name.  When ssh(1) is authenticating a server, this will be
        the host name given by the user, the value of the ssh(1)
        HostkeyAlias if it was specified, or the canonical server
        hostname if the ssh(1) CanonicalizeHostname option was used.
        A pattern may also be preceded by ! to indicate negation: if
        the host name matches a negated pattern, it is not accepted (by
        that line) even if it matched another pattern on the line.  A
        hostname or address  may  op tionally be enclosed within [ and
        ] brackets then followed by : and a non-standard port number.
        Alternately,  hostnames may be stored in a hashed form which
        hides host names and addresses should the file's contents be
        disclosed.  Hashed hostnames start with a | character.  Only
        one hashed hostname may appear on a single line and none of the
        above negation or wildcard operators may be applied.

Metadata