6

I've switched from FTP with TLS to SFTP and now a dialog appears when I try to connect saying Unknown Host Key for www.example.com. Then it presents two options Deny and Allow.

What does this mean? Should I select Allow or Deny?

3
  • When you once permanently accepted the key, and some day you connect and a dialog pops up saying 'the key has changed and different from the local stored key!' - then you should worry and be carefully.
    – Daniel W.
    Jul 6, 2015 at 10:31
  • @DanFromGermany Right. I'm using Cyberduck and it pops up the question every time I connect to upload or refresh the directory. There's an option to [ ] Always accept and that's where I wonder if I select that option will it tell me when it has changed. From what you are saying I can choose always accept and it will tell me if it changes from the stored value. Jul 6, 2015 at 21:01
  • 1
    Usually there are 3 options: 1. Store permanently and warn when it changes 2. Use only once 3. Cancel. There is no Option "accept always even if it changes" because that counters the whole logic behind public key authentication, it would be very unsecure. So yes, it is going to show a big warning when the stored public key and the Server public key dont Match anymore.
    – Daniel W.
    Jul 6, 2015 at 21:23

2 Answers 2

10

SFTP is based upon SSH; hosts you connect to, just like with ssh, will provide you with a unique key which allows you to identify them. If you accept the key, any time in the future you connect to the same host the provided key will be checked against the one provided the first time (which is stored in $HOME/.ssh/known-hosts) and if the two match you will not be asked again; if instead the two keys do not match you will be warned of a possible attack (a Man In The Middle attack, MTIM).

So it is basically a security feature. SSH is based on TOFU (Trust On First Use). Which means you will have to accept the key after checking with the sysadmin that the presented key is indeed theirs, and then proceed to establish the communication.

EDIT:

How to check that we are being presented the right key, short of asking a (possibly non-existent) sysadmin? When you connect to a SSH/SFTP server for the first time, you are presented with something like the following:

    $ ssh me@remote
      The authenticity of host '[remote]:22 ([192.168.1.72]:22)' can't be established.
      ECDSA key fingerprint is b2:2d:52:1a:40:c2:f9:ca:9a:42:86:76:f4:0b:eb:84.
      Are you sure you want to continue connecting (yes/no)? 

Jot down the kind of fingerprint (ECDSA, above) and the fingerprint itself, b2:2d:52:1a:40:c2:f9:ca:9a:42:86:76:f4:0b:eb:84 above. Now go to the server(either physically or, in the case of a VPS, to the console), and, without any need to sudo su, go to /etc/ssh. You will see that there are many .pub files; one is ssh_host_ecdsa_key.pub (the type of fingerprint we were presented). Now issue this command:

   $ ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub

Its output must match the fingerprint you were offered above. If it does, you may now accept the key fingerprint in the ssh session, and proceed to ssh into the server.

There is no need to import anything from the server: ssh will take care of this for you.

2
  • Thank you for the excellent explanation. So if I'm connecting to my web hosting company there should be a location where I can find this key? Then I download it into my known-hosts directory? Jul 6, 2015 at 10:02
  • 1
    @1.21gigawatts Please see my edit. Jul 6, 2015 at 10:26
1

This is a redacted version of my guide Where do I get SSH host key fingerprint to authorize the server?


You should get an SSH host key fingerprint along with your credentials from the server administrator. Knowing the host key fingerprint and thus being able to verify it is an integral part of securing an SSH connection. It prevents man-in-the-middle attacks.

In the real world, most administrators do not provide the host key fingerprint.

If order to achieve the best security possible, you need to connect to the server using the most secure way available. Make any possible precautions to ensure a security of your local machine and a line to the server. For example if you need to obtain the host key to verify connection to the server from an external site (e.g. from home or a client), but you have a physical access to the server site, connect from the server site (e.g. your workplace).

You can also ask anyone with the physical access to the server (ideally the administrator). The host key is only one and hence the same for all users. Also note that the host key fingerprint is generated from a public key part of the host key only. So it is not secret and can be safely sent over an unencrypted (yet trusted) communication channels.

A special case is getting host key of a server, that you are an administrator of yourself, yet you do not have a direct secure line to connect through. This is common for virtual servers or servers in a cloud. In such case a server provider should have a specific solution. For example a specialized server in the same private network as your server, with publicly known host keys. You can connect to this specialized server and from it, securely connect to your server (e.g. using SSH terminal). As you are connecting within private network, you can safely trust any host key. Once connected to your server, acquire its host key. With that you can finally connect directly yet securely over a public network. Alternatively, the server provider can provide the host key via some administrative interface.

For example see my guides for:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .