Re: HEADS UP: OpenSSH with DNSSEC support in 10

From: Dag-Erling Smørgrav <des_at_des.no>
Date: Wed, 11 Sep 2013 17:42:45 +0200
Ian Lepore <ian_at_FreeBSD.org> writes:
> So what happens when there is no dns server to consult?  Will every
> ssh connection have to wait for a long dns query timeout?  What if the
> machine is configured to use only /etc/hosts?

If there is no DNS server, no query will be sent.

> What if a DNS server is configured but doesn't respond?

The DNS request will time out.

In the vast majority of cases, you will either have no DNS at all (so no
query will be sent), or you will have a functioning DNS server.  In a
slightly less vast majority of cases, you will not be able to resolve
the server's IP address without DNS anyway.

> For that matter, I just realized I'm a bit unclear on who is querying
> DNS for this info, the ssh client or the sshd?

The client - and you can override this in your ~/.ssh/config or on the
command line (-oVerifyHostKeyDNS=no).

DES
-- 
Dag-Erling Smørgrav - des_at_des.no
Received on Wed Sep 11 2013 - 13:42:45 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:40:41 UTC