So given the following assumptions:

1) I wish to ssh to a remote host for the first time

2) ssh-keyscan shows this:

pwaugh$ ssh-keyscan -t ecdsa pi                                      
# pi:22 SSH-2.0-OpenSSH_7.4p1 Raspbian-10+deb9u4 pi ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEQVybySS0o5UWGHC0Qq1/pkDWZ0gK4nxUDdQEGdxWo3Dl5XMfMr+m6l5GDo7eID23j3N5Gwh7pGyea3WQbRWAk= pwaugh$

3) ssh pi@pi gives me this:

pwaugh$ ssh pi@pi
The authenticity of host 'pi (' can't be established.
ECDSA key fingerprint is SHA256:eMaAlpPMA2/24ajrpHuiL7mCFCJycZNfuNfyB3cyx+U.
Are you sure you want to continue connecting (yes/no)? no
Host key verification failed.

QUESTION #1: How can I confirm the SHA256 hash of the key returned from the server with ssh is the equivalent of the full key returned by ssh-keyscan?
(other than on the terminal $ sudo ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key)

I'm guessing that if this were possible, it would leave me open to a man-in-the-middle attack, unless I eventually did verify it on the terminal, right?

I'm also guessing that a better method would just be gather the keys, add them to known_hosts, and then let ssh verify them for me anyway. But just curious.

QUESTION #2: When connecting for the first time, and getting the confirm host message/key, it defaults to the ecdsa key. Is this less secure than using the ed25519 key? Can I force it to check that key? (Probably have to delete other host keys I'm guessing)

Thanks for any thoughts. I've reviewed the man files, and even a book on ssh, and just unclear on this.



Where 'pi' is the host of interest, I can request the keys, and then pipe them to ssh-kegen as follows:

$ ssh-keyscan pi | ssh-keygen -lf -
# pi:22 SSH-2.0-OpenSSH_7.4p1 Raspbian-10+deb9u4
# pi:22 SSH-2.0-OpenSSH_7.4p1 Raspbian-10+deb9u4
# pi:22 SSH-2.0-OpenSSH_7.4p1 Raspbian-10+deb9u4
256 SHA256:eMaAlpPMA2/24ajrpHuiL7mCFCJycZNfuNfyB3cyx+U pi (ECDSA)
2048 SHA256:P/Da4p1YbLDgnbGIkVE9SykONlVynPkwwap54RMW6+A pi (RSA)
256 SHA256:cpQtotFCbt4TXxa1474whR1Wkk3gOczhumE23s9pbxc pi (ED25519)
$ _

This is so that I don't have to physically do this on the host:

$ ssh-keygen -lf ./.ssh/known_hosts


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.