Man pages › Compared with Linux and the BSDs

`ssh-keyscan(1)` on Solnix vs Linux and the BSDs

On Solnix, ssh-keyscan is the OpenSSH ssh-keyscan from pkgs.solnix.openssh, and it is in the base system. Its options, defaults and key types match the Linux, FreeBSD, OpenBSD and NetBSD pages in the bundle. The only text difference is a paragraph the Solnix page lacks, warning that the keys cannot be authenticated.

The manual pages

Solnix: ssh-keyscan(1) from pkgs.solnix.openssh
Linux: ssh-keyscan(1) openssh-10.5p1
FreeBSD: ssh-keyscan(1) 15.1-RELEASE
OpenBSD: ssh-keyscan(1) 8.0
NetBSD: ssh-keyscan(1) 11.0

What Solnix runs

A default Solnix system runs the OpenSSH ssh-keyscan, published by pkgs.solnix.openssh and included in the base system packages. No other variants are shipped.

Differences

Compared with	Topic	What differs
all four	same program and options	All five pages list the same flags (`-4` `-6` `-c` `-D` `-f` `-H` `-O` `-p` `-q` `-T` `-t` `-v`). The `-T` default is 5 seconds, and the `-t` types are ecdsa, ed25519, ecdsa-sk, ed25519-sk and rsa. The `-O` hashalg values are sha1 and sha256, with both printed by default. The pages show no difference in options or defaults. Source: Solnix, Linux, FreeBSD, OpenBSD and NetBSD ssh-keyscan(1) SYNOPSIS, -T, -t, -O
Linux, OpenBSD	authenticity warning paragraph	The Linux and OpenBSD pages say ssh-keyscan cannot verify the authenticity of the host keys it obtains. An attacker who can intercept traffic could substitute their own keys, so output should be verified out of band or used directly only on a trusted network. The Solnix page does not contain this paragraph. Source: Linux ssh-keyscan(1) DESCRIPTION; OpenBSD ssh-keyscan(1) DESCRIPTION; Solnix ssh-keyscan(1) DESCRIPTION
FreeBSD, NetBSD	authenticity warning paragraph	The FreeBSD and NetBSD pages have no authenticity paragraph in DESCRIPTION, as on Solnix. All pages keep the man-in-the-middle warning about building ssh_known_hosts files without verifying the keys. Source: FreeBSD ssh-keyscan(1) DESCRIPTION; NetBSD ssh-keyscan(1) DESCRIPTION; Solnix ssh-keyscan(1) DESCRIPTION
all four	no behavioural difference documented	The manual texts show no difference in output format, exit status, environment variables or file locations. Default output is known_hosts format, and `-D` switches to SSHFP records. None of the pages document exit status or environment variables. Source: ssh-keyscan(1) -D on all five systems

Standards

POSIX: ssh-keyscan is not a POSIX.1-2024 utility.
Solnix: The page's SEE ALSO cites RFC 4255, Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints, 2006. The other four pages cite it too. None of the pages has a STANDARDS section.

Writing portable scripts

The same flags work on Solnix, Linux, FreeBSD, OpenBSD and NetBSD, so one invocation such as ssh-keyscan -t ed25519 host is portable across them.
Verify scanned keys out of band before trusting them. All five pages warn about man-in-the-middle attacks when known_hosts is built unverified.

Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.