Add DANE SSHFP and Apple Keychain to the SSH configuration

Author: AgenttiX

ssh/config.d/general.conf

@@ -4,6 +4,11 @@
 # for the options to be applied properly to the hosts defined in other files.
 # https://superuser.com/a/1142813
 
+# For documentation on how to configure SSH, please see these pages:
+# https://www.ssh.com/academy/ssh/config
+# https://linux.die.net/man/5/ssh_config
+
+# Use only the keys configured in the SSH config files, even if the SSH agent offers more identities.
 IdentitiesOnly yes
 
 # Non-Windows systems
@@ -49,11 +54,40 @@ Match exec "uname -a | grep 'Linux'"
 
     ControlPersist 10m
 
+# Ignore the UseKeychain option on non-macOS systems,
+# as it's a custom patch by Apple for OpenSSH on macOS and is not supported on other platforms.
+# https://words.theresnotime.co.uk/2023/ssh-bad-configuration-option-usekeychain/
+IgnoreUnknown UseKeychain
+
 Host *
+    # Automatically add SSH keys to the agent when needed.
+    # This is necessary on macOS to use SSH keys from Apple Keychain.
+    # https://bad.network/basic-ssh-keys-part-2-agent-forwarding-adding-keys.html
+    AddKeysToAgent yes
+
 	# FIDO2 support for Windows
 	# SecurityKeyProvider winhello.dll
 
 	# This prevents connection timeouts
 	ServerAliveInterval 25
 	# This is already set by default.
 	# ServerAliveCountMax 3
+
+    # Check the host key of the server against the known hosts file, and refuse to connect if it has changed.
+    # The default value is "ask".
+    # https://www.eukhost.com/kb/how-to-enable-stricthostkeychecking-in-ssh/
+    # StrictHostKeyChecking ask
+
+    # Use Apple Keychain on macOS
+    # https://apple.stackexchange.com/a/250572
+    # https://blog.fernvenue.com/archives/how-to-use-keychain-for-ssh-on-macos/
+    UseKeychain yes
+
+    # Use SSHFP DNS records, if available, to verify the identity of the server.
+    # If the DNS record is not signed with DNSSEC or the client does not use DNSSEC,
+    # then fall back to the default behavior of asking the user to verify the host key
+    # and storing it in the known hosts file.
+    # When this is set to "ask",
+    # the user will still need to confirm new host keys according to the StrictHostKeyChecking option.
+    # https://en.wikipedia.org/wiki/SSHFP_record
+    VerifyHostKeyDNS ask