Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm running Ubuntu on my work PC, and my work place provides me with a static IP address but not with a domain. It's sometimes useful for me to connect to that PC through ssh, but it's not common enough for me to instantly remember the IP number. So I set um a dyndns account, and associated a short and intuitive domain name to that IP.

Here's my question, when I try to ssh to the domain, it asks me

$ ssh me@something.there.foo
The authenticity of host 'something.there.foo (xx.xx.xx.xx)' can't be established.
RSA key fingerprint is 'ALPHANUMERIC STRING'
Are you sure you want to continue connecting (yes/no)?

That surprised me a little bit. I have already registered the RSA fingerprint by connecting directly to the IP address. I thought the domain name was simply a convenient way of pointing me in the right direction (i. e. the ip address), but that message makes me think my data is actually going through their servers or something.

Which one is it? Am I sending my password through someone else's server? Or is ssh just really really careful, thus warning me even if the final destination is a know host?

The ssh server I'm using is the openssh-server package.

share|improve this question

3 Answers 3

up vote 7 down vote accepted

ssh is asking again; just because you connected to a host doesn't mean you trust that host to be the real something.there.foo.

You can compare the fingerprints to check they are indeed the same host:

diff -u <(ssh-keygen -F something.there.foo -l) <(ssh-keygen -F xx.xx.xx.xx -l)

There are ways to put the key fingerprint in DNS, but without DNSSEC security won't increase much.

Once you have connected to the host you can trust ssh to warn you if it changes.

share|improve this answer
1  
Interesting, I thought ssh was asking me whether I trusted dyndns, but actually it was asking me whether I trusted my laptop as the final destination of the domain I asked for. –  Malabarba Jun 12 '10 at 3:11

You aren't sending through their servers. The reason for the alert is the domain/ip isn't dns reversible. Which means when you dns the ip it does not come out as something.there.foo.

share|improve this answer

If you haven't accessed the server via something.there.foo, it will ask even if you've accessed the same server via other methods (ip address or alternate domain).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.