Locking down ssh config in large env

        Hi;

        I am looking for some ideas on howto lock down ssh for a large
deployment of unix hosts. Specifically, I would like to be able to tell the
ssh cli program to ignore individual users .ssh/ssh_config files and only
reference the global ssh_config file, (eg: /usr/local/etc/ssh_config). Most
of my users home directories are mounted via automounter from a central
location.

        I am also looking for a way in which to have ssh only reference a
global known_hosts file (eg: /usr/local/etc/known_hosts) and completely
ignore individual users .ssh/known_hosts entries. Effectively what I want is
a centrally managed and distributed known_hosts file to be used in
conjunction with StrictHostKeyChecking to not allow ssh connections from
hosts not listed in the global known_hosts file. The global known_hosts file
would be a read-only file for everyone but administrators. The use of
StrictHostKeyChecking ties into my desire to ignore users ssh_config files
and rely only on the global file - I don't want users to be able to override
StrictHostKeyChecking. VerifyHostKeyDNS has a great deal of appeal, but a
number of my clients (Sun SSH for example) do not yet support this option.
Also I have some issues with getting a recent bind deployment in place to
support SSHFP keys. 

        Any input is greatly appreciated.

        TIA,

        Chris