.. versionadded:: 2018.3.0

    Retrieve information about host public keys from remote server

    hostname
        The name of the remote host (e.g. "github.com")

    enc
        Defines what type of key is being used, can be ed25519, ecdsa ssh-rsa
        or ssh-dss

    port
        Optional parameter, denoting the port of the remote host on which an
        SSH daemon is running. By default the port 22 is used.

    hash_known_hosts : True
        Hash all hostnames and addresses in the known hosts file.

    timeout : int
        Set the timeout for connection attempts.  If ``timeout`` seconds have
        elapsed since a connection was initiated to a host or since the last
        time anything was read from that host, then the connection is closed
        and the host in question considered unavailable.  Default is 5 seconds.

    fingerprint_hash_type
        The fingerprint hash type that the public key fingerprints were
        originally hashed with. This defaults to ``sha256`` if not specified.

        .. versionadded:: 2016.11.4
        .. versionchanged:: 2017.7.0: default changed from ``md5`` to ``sha256``

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.recv_known_host_entries <hostname> enc=<enc> port=<port>

def recv_known_host_entries(hostname,
                            enc=None,
                            port=None,
                            hash_known_hosts=True,
                            timeout=5,
                            fingerprint_hash_type=None):
    '''
    .. versionadded:: 2018.3.0

    Retrieve information about host public keys from remote server

    hostname
        The name of the remote host (e.g. "github.com")

    enc
        Defines what type of key is being used, can be ed25519, ecdsa ssh-rsa
        or ssh-dss

    port
        Optional parameter, denoting the port of the remote host on which an
        SSH daemon is running. By default the port 22 is used.

    hash_known_hosts : True
        Hash all hostnames and addresses in the known hosts file.

    timeout : int
        Set the timeout for connection attempts.  If ``timeout`` seconds have
        elapsed since a connection was initiated to a host or since the last
        time anything was read from that host, then the connection is closed
        and the host in question considered unavailable.  Default is 5 seconds.

    fingerprint_hash_type
        The fingerprint hash type that the public key fingerprints were
        originally hashed with. This defaults to ``sha256`` if not specified.

        .. versionadded:: 2016.11.4
        .. versionchanged:: 2017.7.0: default changed from ``md5`` to ``sha256``

    CLI Example:

    .. code-block:: bash

        salt '*' ssh.recv_known_host_entries <hostname> enc=<enc> port=<port>
    '''
    # The following list of OSes have an old version of openssh-clients
    # and thus require the '-t' option for ssh-keyscan
    need_dash_t = ('CentOS-5',)

    cmd = ['ssh-keyscan']
    if port:
        cmd.extend(['-p', port])
    if enc:
        cmd.extend(['-t', enc])
    if not enc and __grains__.get('osfinger') in need_dash_t:
        cmd.extend(['-t', 'rsa'])
    cmd.extend(['-T', six.text_type(timeout)])
    cmd.append(hostname)
    lines = None
    attempts = 5
    while not lines and attempts > 0:
        attempts = attempts - 1
        output = __salt__['cmd.run'](cmd, python_shell=False)

    # This is a workaround because ssh-keyscan hashing is broken for
    # non-standard SSH ports on basically every platform. See
    # https://github.com/saltstack/salt/issues/40152 for more info.
    if hash_known_hosts:
        # Use a tempdir, because ssh-keygen creates a backup .old file
        # and we want to get rid of that. We won't need our temp keys
        # file, either.
        tempdir = tempfile.mkdtemp()
        try:
            filename = os.path.join(tempdir, 'keys')
            with salt.utils.files.fopen(filename, mode='w') as f:
                f.write(output)
            cmd = ['ssh-keygen', '-H', '-f', filename]
            __salt__['cmd.run'](cmd, python_shell=False)
            # ssh-keygen moves the old file, so we have to re-open to
            # read the hashed entries
            with salt.utils.files.fopen(filename, mode='r') as f:
                output = f.read()
        finally:
            shutil.rmtree(tempdir, ignore_errors=True)
    lines = output.splitlines()
    known_host_entries = list(_parse_openssh_output(lines,
                                             fingerprint_hash_type=fingerprint_hash_type))
    return known_host_entries if known_host_entries else None