Hacker News Reader

You can also address TOFU to some extent using SSHFP DNS records.

Openssh supports checking the DNSSEC signature in the client, in theory, but it's a configure option and I'm not sure if distros build with it.

View on HN

On top of that you would need something to secure DNS. Like DNSSEC or at the very least use DNS with TLS or DNS over HTTP. None of these are typically enabled by default.

Anything that uses system-resolved is probably doing DNSSEC validation by default. It's becoming much more common.

Additionally, as I mentioned, openssh itself has support for validating the DNSSEC signature even if your local resolver doesn't. I actually don't think it can use the standard resolver for SSHFP records at all, but I'm not sure.

Any idea if there's a standardized location, something like /.well-known/ssh?

This exists, but not very well supported: https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts....

But DNSSEC + SSHFP is a better supported solution at the moment

Reply on news.ycombinator.com