{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12470","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12470/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12470/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12470/events","html_url":"https://github.com/NixOS/nixpkgs/issues/12470","id":127419271,"number":12470,"title":"openssh VerifyHostKeyDNS=yes can not verify sshfp-rr via dnssec","user":{"login":"enko","id":19407,"avatar_url":"https://avatars.githubusercontent.com/u/19407?v=3","gravatar_id":"","url":"https://api.github.com/users/enko","html_url":"https://github.com/enko","followers_url":"https://api.github.com/users/enko/followers","following_url":"https://api.github.com/users/enko/following{/other_user}","gists_url":"https://api.github.com/users/enko/gists{/gist_id}","starred_url":"https://api.github.com/users/enko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/enko/subscriptions","organizations_url":"https://api.github.com/users/enko/orgs","repos_url":"https://api.github.com/users/enko/repos","events_url":"https://api.github.com/users/enko/events{/privacy}","received_events_url":"https://api.github.com/users/enko/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-01-19T10:53:04Z","updated_at":"2016-01-19T17:44:16Z","closed_at":null,"body":"When I try to ssh into a box where I have configured some sshfp-rr with dnssec, I get get the prompt that the authenticity of the host could not be established. Here is a trimmed debug output:\r\n\r\n```\r\n$ ssh -v -o \"VerifyHostKeyDNS yes\" xmpp.int.datenknoten.me\r\nOpenSSH_6.9p1, OpenSSL 1.0.1q 3 Dec 2015\r\n[…]\r\ndebug1: found 6 insecure fingerprints in DNS\r\ndebug1: matching host key fingerprint found in DNS\r\nThe authenticity of host 'xmpp.int.datenknoten.me (192.168.122.4)' can't be established.\r\nECDSA key fingerprint is SHA256:Znv9jefZTVrOGqovEI+sg29V1Nyo6d19qid+eFVqxiE.\r\nMatching host key fingerprint found in DNS.\r\nAre you sure you want to continue connecting (yes/no)?\r\n```\r\n\r\nWhen I dig the the corresponding sshfp record I get the `ad` flag, so they should be secure?:\r\n\r\n```\r\n$ dig xmpp.int.datenknoten.me -t sshfp                                                                                       ~\r\n\r\n; <<>> DiG 9.10.3 <<>> xmpp.int.datenknoten.me -t sshfp\r\n;; global options: +cmd\r\n;; Got answer:\r\n;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63175\r\n;; flags: qr rd ra ad; QUERY: 1, ANSWER: 6, AUTHORITY: 2, ADDITIONAL: 5\r\n\r\n;; OPT PSEUDOSECTION:\r\n; EDNS: version: 0, flags:; udp: 4096\r\n;; QUESTION SECTION:\r\n;xmpp.int.datenknoten.me.       IN      SSHFP\r\n\r\n;; ANSWER SECTION:\r\nxmpp.int.datenknoten.me. 2955   IN      SSHFP   1 1 EEFA7FC1182780197F8D499FD2A4D7D1D3828F7C\r\nxmpp.int.datenknoten.me. 2955   IN      SSHFP   3 1 7E27B08A6BFB87882A3255CE9424C85748DFF54B\r\nxmpp.int.datenknoten.me. 2955   IN      SSHFP   2 2 471620FB90B43B2C757091CE23F883D665CF148D1F4A750A28053685 40A4F654\r\nxmpp.int.datenknoten.me. 2955   IN      SSHFP   2 1 D1E16C35F86A1F23EB518813E94923C0E359E6AB\r\nxmpp.int.datenknoten.me. 2955   IN      SSHFP   3 2 667BFD8DE7D94D5ACE1AAA2F108FAC836F55D4DCA8E9DD7DAA277E78 556AC621\r\nxmpp.int.datenknoten.me. 2955   IN      SSHFP   1 2 D2C812B6EA990AC9E1BA8FD6ECAAE9E3F01301D31F5461ED79541F0A C3BEBBF7\r\n```\r\n\r\nOn a freebsd box with OpenSSH_6.6.1p1 and a debian box with OpenSSH_6.7p1 this feature works flawless: I can login without manual intervention."},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/172930286","html_url":"https://github.com/NixOS/nixpkgs/issues/12470#issuecomment-172930286","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/12470","id":172930286,"user":{"login":"peti","id":28323,"avatar_url":"https://avatars.githubusercontent.com/u/28323?v=3","gravatar_id":"","url":"https://api.github.com/users/peti","html_url":"https://github.com/peti","followers_url":"https://api.github.com/users/peti/followers","following_url":"https://api.github.com/users/peti/following{/other_user}","gists_url":"https://api.github.com/users/peti/gists{/gist_id}","starred_url":"https://api.github.com/users/peti/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/peti/subscriptions","organizations_url":"https://api.github.com/users/peti/orgs","repos_url":"https://api.github.com/users/peti/repos","events_url":"https://api.github.com/users/peti/events{/privacy}","received_events_url":"https://api.github.com/users/peti/received_events","type":"User","site_admin":false},"created_at":"2016-01-19T17:44:16Z","updated_at":"2016-01-19T17:44:16Z","body":"The option `networking.extraResolvconfConf` from `configuration.nix` allows you to set extra things to pass to the `resolvconf` program that generates that file. Maybe that helps?"}}