[Bug 2591] New: ssh-keygen -R is case-sensitive, but should not be
bugzilla-daemon at bugzilla.mindrot.org
bugzilla-daemon at bugzilla.mindrot.org
Sat Jun 18 06:41:00 AEST 2016
https://bugzilla.mindrot.org/show_bug.cgi?id=2591
Bug ID: 2591
Summary: ssh-keygen -R is case-sensitive, but should not be
Product: Portable OpenSSH
Version: -current
Hardware: All
OS: All
Status: NEW
Severity: minor
Priority: P5
Component: ssh-keygen
Assignee: unassigned-bugs at mindrot.org
Reporter: griff.miller at oplink.net
Hostnames and domains are case-insensitive, but ssh-keygen -R is not
honoring this.
With openssh-7.2p2 Cygwin/Windows 7 (I've also seen the same behavior
on
RHEL/CentOS with 5.3p1 and 6.6.1p1):
% grep -i myhost ~/.ssh/known_hosts # to show myhost is not there yet
% ssh gmiller at Myhost.domain.com date # this will put myhost there if
I say
"yes", which I will do. Note mixed case.
The authenticity of host 'myhost.domain.com (1.2.3.4)' can't be
established.
RSA key fingerprint is
SHA256:kr1BeHAQgtdws3gB1NPpKtVDm9OPJ8Gg1loyiDC1z8Y.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'myhost.domain.com,1.2.3.4' (RSA) to the
list
of known hosts.
Fri Apr 15 15:19:54 EDT 2016
% grep -i myhost ~/.ssh/known_hosts # to show that myhost is now in
known_hosts - note it has been smashed to lowercase, which is okay.
myhost.domain.com,1.2.3.4 ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAIEAwBsMvQ0wMfDKDXJT092F3NWjv840AHpzP0MWR+vAK1t+Uu5fjh2Jh93GFtwUH6BHCKntA7ZRTryk8xFGxlXy1NEmBzMkzNEDzWtVKBSTwnyxUZHs81r6DWBmJbsqny+lxYcUIUWMvjHis8ms6fT9G5rfde0hoLQzUSCN+L3cE1k=
% ssh-keygen -R Myhost.domain.com # now try to remove it. Case should
not
matter here.
Host Myhost.domain.com not found in /home/millerig/.ssh/known_hosts
% grep -i myhost ~/.ssh/known_hosts # ...but it does. Show that it is
still there.
myhost.domain.com,1.2.3.4 ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAIEAwBsMvQ0wMfDKDXJT092F3NWjv840AHpzP0MWR+vAK1t+Uu5fjh2Jh93GFtwUH6BHCKntA7ZRTryk8xFGxlXy1NEmBzMkzNEDzWtVKBSTwnyxUZHs81r6DWBmJbsqny+lxYcUIUWMvjHis8ms6fT9G5rfde0hoLQzUSCN+L3cE1k=
% ssh-keygen -R myhost.domain.com # this time it will work because we
made
sure to use lower case.
# Host myhost.domain.com found: line 14
/home/millerig/.ssh/known_hosts updated.
Original contents retained as /home/millerig/.ssh/known_hosts.old
% grep -i myhost ~/.ssh/known_hosts # show that it's gone
%
Seems like ssh-keygen -R is performing a case-sensitive string compare
on
the provided hostname and the hostnames in the known_hosts file. It
should
be a case-insensitive compare.
I can fix my scripts so that I convert to lowercase before calling
ssh-keygen -R, but it would be nice if this could be fixed so that
others
don't get caught by surprise.
P.S. The same issue exists for the domain portion of the
fully-qualified
hostname.
P.P.S. I will upload a patch that I did, with input from Ángel
González.
--
You are receiving this mail because:
You are watching the assignee of the bug.
More information about the openssh-bugs
mailing list