Comment on Improving the security of your SSH private key filesparentComments−mike-cardwell13yYou can put SSHFP records in the DNS. See "VerifyHostKeyDNS" in the SSH man page. You'll also want DNSSEC set up of course.−peterwwillis13yAfter you get a validating stub resolver, since your OS probably doesn't ship with one by default.−mike-cardwell13yDoesn't take long to do an "apt-get install unbound" and then modify your network settings to use 127.0.0.1 as your resolver.−rscale13yAnd if you're using a DNS service that doesn't support SSHFP records, you can generate and distribute a base known_hosts file with your favorite configuration management solution.
Comments
You can put SSHFP records in the DNS. See "VerifyHostKeyDNS" in the SSH man page. You'll also want DNSSEC set up of course.
After you get a validating stub resolver, since your OS probably doesn't ship with one by default.
Doesn't take long to do an "apt-get install unbound" and then modify your network settings to use 127.0.0.1 as your resolver.
And if you're using a DNS service that doesn't support SSHFP records, you can generate and distribute a base known_hosts file with your favorite configuration management solution.