From: Lucas de Sena <lucas@seninha.org>
Subject: ssh.1: use public key on example "ssh-keygen -l" command
To: tech@openbsd.org
Date: Sat, 1 Aug 2026 23:56:06 -0300

Use the public key on example command for ssh-keygen(1).

The prompt here ($) implies that the command is run by a regular user,
which should have no read access to the host private key.  And even if
it were run by root, ssh-keygen(1) finds and uses the corresponding
public key anyway, yielding the same result.

-- 
Lucas de Sena

diff /usr/src
path + /usr/src
commit - f8480ad0276ad54ce9f7ed2b2004c86f9f1a9521
blob - 747a126a1d19aca620769dda933a0d0f3febe9fc
file + usr.bin/ssh/ssh.1
--- usr.bin/ssh/ssh.1
+++ usr.bin/ssh/ssh.1
@@ -1184,7 +1184,7 @@ has been disabled).
 Fingerprints can be determined using
 .Xr ssh-keygen 1 :
 .Pp
-.Dl $ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key
+.Dl $ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub
 .Pp
 If the fingerprint is already known, it can be matched
 and the key can be accepted or rejected.