Vinícius Ferrão via FreeIPA-users wrote:
Hello,
I’m trying to implement SSH Hostbased Authentication between IPA joined machines but I’m
with difficulties regarding:
* The /etc/ssh/ssh_known_hosts file.
In a FreeIPA environment the known_hosts are stored on IPA, and I’m aware of the
ProxyCommand /usr/bin/sss_ssh_knownhostsproxy; but how can I create this file with the
entries from FreeIPA?
Why do you want to? That is the point of the proxy, so dynamic files
don't need to be maintained.
* Another issue is with the /etc/ssh/shosts.equiv file.
It supports plain hostnames or netgroups, which is a NIS thing. FreeIPA offers any
netgroups compatibility? I’m expecting to put something like: @nodes on this file to keep
it simple. Any changes on IPA hosts would be reflected automatically.
IPA hostgroups are automatically mirrored as netgroups.
rob