<html><head></head><body><div><div><div class=""><div class=""><div class=""><div class=""><br></div></div><br><div class="sh-signature"><div class="gmail_signature"><br></div></div></div><br><div class="sh-quoted-content"><div class=""><div class="gmail_quote">On Wed, Feb 26, 2025 at 7:47 PM, George Michaelson <span dir="ltr" class=""><<a href="mailto:ggm@algebras.org" target="_blank" class="">ggm@algebras.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_extra"><div class="gmail_quote"><div dir="ltr" class=""><div dir="ltr" class="">In the same spirit, I know a group using them but they're so prone to bitrot, from OS upgrade, which with virtuals is a low cost operation and mostly avoids issues for the real job of the machine: individuals keying info is in their home states which copy in from other places, but the SSHFP information is recreated in the new VM build, and then nobody remembers to update the central view.<div class=""><br></div><div class="">I think the record itself structurally is fine. But the operational duty cycle over it, is probably not adequately integrated into systems. <br></div></div></div></div></div></blockquote></div></div></div></div><div><div><br></div><div>Yeah, that was Jan-Piet Mens' facts2sshfp (<a href="https://github.com/jpmens/facts2sshfp">https://github.com/jpmens/facts2sshfp</a>) was intending to solve. When I used Puppet for my system-admin stuff this worked nicely. Puppet would know about all of my machines, and would automagically update my SSHFP records. <br></div><div><br></div><div>However, I was unable (well, unwilling) to deal with the number of breaking changes to Puppet's syntax, and so I migrated to Ansible instead, and never re-integrated this into my workflow. <br></div><div><br></div><div>In theory this should be sim… Oh, actually it looks like Jan-Piet has already done this as well: <a href="https://jpmens.net/2012/11/03/an-action-plugin-for-ansible-to-handle-ssh-host-keys/">https://jpmens.net/2012/11/03/an-action-plugin-for-ansible-to-handle-ssh-host-keys/</a><br></div><div><br></div><div>W</div><div><br></div><div><br></div></div><div class=""><div class="sh-quoted-content"><div class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_extra"><div class="gmail_quote"><div dir="ltr" class=""><div dir="ltr" class=""><div class="">"Don't forget to update your SSHFP record for this host" or "I am re-using the host SSHID information you copied into my install process" type stories would help.<br></div><div class=""><br></div><div class="">-G<br></div></div></div>
<p class="">_______________________________________________
<br>
dns-operations mailing list
<br>
<a target="_blank" rel="noopener noreferrer" href="mailto:dns-operations@lists.dns-oarc.net" class="">dns-operations@<wbr>lists.<wbr>dns-oarc.<wbr>net</a>
<br>
<a target="_blank" rel="noopener noreferrer" href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" class="">https:/<wbr>/<wbr>lists.<wbr>dns-oarc.<wbr>net/<wbr>mailman/<wbr>listinfo/<wbr>dns-operations</a></p></div></div></blockquote></div></div></div></div><div><br></div></div><div></div></div></body></html>