UpdateHostkeys now enabled by default

[Damien Miller]

On Sat, 3 Oct 2020, Mark D. Baushke wrote:

> Hi Damien,
> 
> UpdateHostkeys is an interesting feature. I hope you plan to document it
> somewhat better in the ssh_config.5 file than is currently present?
> 
> My reading of the documentation is that it is ambiguous as to the
> following:
> 
>   if StrictHostKeyChecking=yes and UpdateHostkeys=yes
>   which option wins?
> 
>   (My vote is that StrictHostKeyChecking=yes wins every time.)

They are almost completely separate:

StrictHostKeyChecking controls the circumstances under which a hostkey
is accepted.

UpdateHostkeys controls whether to try to learn additional hostkeys
for a host with an already trusted host key.

The small point of interaction is when StrictHostKeyChecking=no and
the user elects to continue past a changed hostkey. I'll double-check
to make sure that UpdateHostkeys gets turned off along the other options
that are disabled in this case.

>   If the hostkey that matches is found in GlobalKnownHostsFile, then I
>   hope that the UpdateHostKeys is NOT used to update the
>   UserKnownHostsFile ... 
> 
>   My vote is to assume that the GlobalKnownHostsFile is being properly
>   managed and maintained for the listed hosts and UpdateHostKeys would
>   be ignored in this case.

Good point. I'll implement this.

>   I am unclear what happens with UpdateHostKeys when the key is found
>   via DNS SSHFP and the use of VerifyHostKeyDNS settings. 
> 
>   My vote is that if the key is found in DNS SSHFP records, the
>   UpdateHostKeys does NOT get used to add to the UserKnownHostsFile.

Another good point. I'll do this too :)

>   How do CheckHostIP=yes and UpdateHostKeys play together?
>   It is not clear to me if the HostIP fingerprints AND the Hostname
>   fingerprint recards are BOTH to be added via the UpdateHostKeys
>   directive or not.

They should play just fine (modulo bugs like the one Matthieu reported).
Keys learned by UpdateHostKeys should behave exactly like ones learned
by TOFU with respect to CheckHostIP and HashKnownHosts.

-d