---
name: "sss_ssh_knownhosts"
section: "1"
platform: "linux"
package: "sssd"
version: "2.13.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/sss_ssh_knownhosts"
---

# sss\_ssh\_knownhosts(1)

get OpenSSH known hosts public keys

## NAME

sss\_ssh\_knownhosts - get OpenSSH known hosts public keys

## SYNOPSIS

**sss\_ssh\_knownhosts** \[*options*\] *HOST*

## DESCRIPTION

**sss\_ssh\_knownhosts** acquires SSH public keys for host *HOST* and outputs them in OpenSSH known\_hosts key format (see the “SSH\_KNOWN\_HOSTS FILE FORMAT” section of [**sshd**(8)](/sshd/8.md) for more information).

[**ssh**(1)](/ssh/1.md) can be configured to use **sss\_ssh\_knownhosts** for public key host authentication using the “KnownHostsCommand” option:

```
                KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H
```

Please refer to the [**ssh\_config**(5)](/ssh_config/5.md) man page for more details about this option.

This tool requires that SSSD's ssh service is enabled to work properly.

## OPTIONS

- **-d**,**--domain** *DOMAIN*

  Search for host public keys in SSSD domain *DOMAIN*.

- **-o**,**--only-host-name**

  When the keys retrieved from the backend do not include the hostname, this tool will add the unmodified hostname as provided by the caller. If this flag is set, only the hostname (no port number) will be added to the keys.

- **-?**,**--help**

  Display help message and exit.

## KEY RETRIEVAL

The key lines retrieved from the backend are expected to respect the key format as described in the “SSH\_KNOWN\_HOSTS FILE FORMAT” section of [**sshd**(8)](/sshd/8.md). However, returning only the keytype and the key itself is tolerated, in which case, the hostname received as parameter will be added before the keytype to output a correctly formatted line. The hostname will be added unmodified or just the hostname (no port number), depending on whether the **-o**,**--only-host-name** option was provided.

When the SSH server is listening on a non-default port, the backend MUST provide the hostname including the port number in the correct format and position as part of the key line. For example, the minimal key line would be:

```
                [canonical.host.name]:2222 <keytype> <base64-encoded key>
```

## EXIT STATUS

In case of successful execution, even if no key was found for that host or if the ssh responder could not be contacted, 0 is returned. 1 is returned in case of any other error.

## SEE ALSO

[**sssd**(8)](/sssd/8.md), [**sssd.conf**(5)](/sssd.conf/5.md), [**sssd-ldap**(5)](/sssd-ldap/5.md), [**sssd-ldap-attributes**(5)](/sssd-ldap-attributes/5.md), [**sssd-krb5**(5)](/sssd-krb5/5.md), [**sssd-simple**(5)](/sssd-simple/5.md), [**sssd-ipa**(5)](/sssd-ipa/5.md), [**sssd-ad**(5)](/sssd-ad/5.md), [**sssd-idp**(5)](/sssd-idp/5.md), [**sssd-sudo**(5)](/sssd-sudo/5.md), [**sssd-session-recording**(5)](/sssd-session-recording/5.md), [**sss\_cache**(8)](/sss_cache/8.md), [**sss\_debuglevel**(8)](/sss_debuglevel/8.md), [**sss\_obfuscate**(8)](/sss_obfuscate/8.md), [**sss\_seed**(8)](/sss_seed/8.md), [**sssd\_krb5\_locator\_plugin**(8)](/sssd_krb5_locator_plugin/8.md), [**sss\_ssh\_authorizedkeys**(1)](/sss_ssh_authorizedkeys/1.md), [**sss\_ssh\_knownhosts**(1)](/sss_ssh_knownhosts/1.md), [**sssd-ifp**(5)](/sssd-ifp/5.md), [**pam\_sss**(8)](/pam_sss/8.md). [**sss\_rpcidmapd**(5)](/sss_rpcidmapd/5.md)

## AUTHORS

**The SSSD upstream - https://github.com/SSSD/sssd/**