So given the following assumptions:
1) I wish to ssh to a remote host for the first time
2) ssh-keyscan shows this:
pwaugh$ ssh-keyscan -t ecdsa pi # pi:22 SSH-2.0-OpenSSH_7.4p1 Raspbian-10+deb9u4 pi ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEQVybySS0o5UWGHC0Qq1/pkDWZ0gK4nxUDdQEGdxWo3Dl5XMfMr+m6l5GDo7eID23j3N5Gwh7pGyea3WQbRWAk= pwaugh$
3) ssh pi@pi gives me this:
pwaugh$ ssh pi@pi The authenticity of host 'pi (192.168.1.12)' can't be established. ECDSA key fingerprint is SHA256:eMaAlpPMA2/24ajrpHuiL7mCFCJycZNfuNfyB3cyx+U. Are you sure you want to continue connecting (yes/no)? no Host key verification failed. pwaugh$
How can I confirm the SHA256 hash of the key returned from the server with ssh is the equivalent of the full key returned by ssh-keyscan?
(other than on the terminal $ sudo ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key)
I'm guessing that if this were possible, it would leave me open to a man-in-the-middle attack, unless I eventually did verify it on the terminal, right?
I'm also guessing that a better method would just be gather the keys, add them to known_hosts, and then let ssh verify them for me anyway. But just curious.
QUESTION #2: When connecting for the first time, and getting the confirm host message/key, it defaults to the ecdsa key. Is this less secure than using the ed25519 key? Can I force it to check that key? (Probably have to delete other host keys I'm guessing)
Thanks for any thoughts. I've reviewed the man files, and even a book on ssh, and just unclear on this.