From 67637180b7dcccc83b1999e4129e78c71bf37bfa Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Feb 19 2025 19:15:35 +0000
Subject: sshaccess: drop VerifyHostKeyDNS


This is nice and all, but unless you have dnssec enabled, it
could be you get redirected to a attacker host.
We also no longer mention sshfp anywhere here, so makes sense to just
drop it.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>

---

diff --git a/modules/sysadmin_guide/pages/sshaccess.adoc b/modules/sysadmin_guide/pages/sshaccess.adoc
index 1c62635..61c6b6c 100644
--- a/modules/sysadmin_guide/pages/sshaccess.adoc
+++ b/modules/sysadmin_guide/pages/sshaccess.adoc
@@ -67,7 +67,6 @@ Host bastion.fedoraproject.org
   User FAS_USERNAME (all lowercase)
   ProxyCommand none
   ForwardAgent no
-  VerifyHostKeyDNS yes
 Host *.iad2.fedoraproject.org *.qa.fedoraproject.org 10.3.160.* 10.3.161.* 10.3.163.* 10.3.165.* 10.3.167.* 10.3.171.* *.vpn.fedoraproject.org
   ProxyJump bastion.fedoraproject.org
 Host batcave01