What does `ssh-keygen -r` do if a public key is not specified?

Question

Short Question

I'm assuming that ssh-keygen -r hostname uses a default public key. I would have thought that it would default to ~/.ssh/id_rsa.pub, but that does not appear to be the case. So what is it doing?

Long Version

My experience with the OpenSSH command-line utilities is that they either prompt the user for any missing arguments or fall back to standard default values. But for ssh-keygen -r this does not appear to be the case. When I run the ssh-keygen -r command without specifying a public key (e.g. ssh-keygen -r hostname), I get the following output:

no keys found.

I would expect it to default to my public key, e.g. ~/.ssh/id_rsa.pub. However, this does not appear to be the case, since when I pass in this public key explicitly (e.g. ssh-keygen -r hostname -f ~/.ssh/id_rsa.pub) I instead get output of the following form:

hostname IN SSHFP 1 1 5d6c87ef4e8f4f59974f05723ff3dc0cffc9c4b4
hostname IN SSHFP 1 2 8fa151e7f3ba43fa89c240ab236f0313aea1fe9f9e9f4e5b8f084ca0008399ed

Moreover, the man page for ssh-keygen shows the following syntax for the ssh-keygen -r command:

ssh-keygen -r hostname [-f input_keyfile] [-g]

Since the -f input_keyfile flag is denoted as being optional, I would expect ssh-keygen to do something other than just print an error message.

So, if ssh-keygen -r hostname does not use ~/.ssh/id_rsa.pub as its default public key, and it doesn't prompt the user to specify a public key, then what is it doing? Is it defaulting to some other path? If so, what path is that?

NOTE: I'm running OpenSSH Version 7.6 on macOS High Sierra (Mac OS X Version 10.13.6).

Answer 1

ssh-keygen -r generates a SSHFP record. That's something you put in a DNS entry to say indicate the host key corresponding to a host name. This allows someone who wants to log into your machine to know what host key to expect, assuming that they trust the DNS record (which in practice means that it must be obtained using DNSSEC).

So naturally ssh-keygen -r looks for the host key of your machine. It isn't interested in a user key — if you force it to read a user key, it might work, but the result isn't useful. ssh-keygen -r looks at /etc/ssh_host_*_key.pub, or wherever the SSH server has been configured to look for the host's keys. If you don't have an SSH server set up on your machine, you have no use for an SSHFP record, so it isn't a problem that ssh-keygen -r doesn't find a key.