mandos-keygen --password generates malformed config with ssh-keyscan >= 9.8

bb bb at tsufeki.eu
Wed Nov 13 13:25:58 CET 2024


Hi,

openssh's ssh-keyscan since [version 9.8][1] includes comments in
standard output:

     $ ssh-keyscan -t ecdsa-sha2-nistp256 localhost 2>/dev/null
     # localhost:22 SSH-2.0-OpenSSH_9.9p1 Debian-3
     localhost ecdsa-sha2-nistp256 AAAA...4=

This causes mandos-keygen --password to emit malformed config:
ssh_fingerprint includes both lines, second one is not indented. Checker
command would not work well with such value anyway.

Precisely, packages I used are from Debian testing amd64:

* mandos-client 1.8.17-1
* openssh-client 1:9.9p1-3

Thank you

[1]: https://www.openssh.com/txt/release-9.8


More information about the Mandos-Dev mailing list