openssh unix dev - Aug 2015 - Bootstrapping SSH security

Hey,

What is the canonical way that SSH security should be bootsrapped. How
are users expected to know if fingerprint is correct or not?
To me canonical way seems that it's not done, at all, only very very
few use communicate the fingerprints somehow.

Are there reasons why we couldn't out-of-the-package trust on SSHFP
when found with validating DNSSEC?
Those few how have higher security requirements could manually turn it
off. I feel it would be net-gain on security, but I may have missed
some important arguments.

Thanks,
-- 
  ++ytti

In your letter dated Wed, 19 Aug 2015 08:44:47 +0300 you
wrote:
>Are there reasons why we couldn't out-of-the-package trust on SSHFP
>when found with validating DNSSEC?
There is currently some support for SSHFP in openssh, but it doesn't really
work.

I created a patch to fix the issue and put a fork up on github:
https://github.com/phicoh/openssh-getdns/tree/getdns

Note that you have to enable this in configure with '--with-getdns' and
use -o 'VerifyHostKeyDNS yes' to enable the feature at runtime.