I just installed Linux Mint as a VM. I installed OpenSSH and then moved to the host (macOS) and opened a Bash session in the Terminal to SSH to the Linux Mint VM. When I did I got the message
The authenticity of host '<<IP address>>' port <<port#>>: can't be established.
ECDSA key fingerprint is SHA256:<<blahblahblahblahblahblah>>.
Are you sure you want to continue connecting (yes/no)?
Did I do something wrong in the setup here and if so how to correct?
Did I do something wrong in the setup here and if so how to correct?
You’re fine. When you first connect to a new host — not just on Linux machines but even if you were to connect to another macOS host — it will ask you that question:
Are you sure you want to continue connecting (yes/no)?
Just answer yes and that host’s hash/fingerprint value will be added to ~/.ssh/known_hosts in your home directory. Check it out for yourself; just open up ~/.ssh/known_hosts using Nano (nano ~/.ssh/known_hosts) or any other text editor before answering yes, then run that SSH command again, answer yes and check it out again. The new host’s hash/fingerprint value will be at the bottom of that file.
The benefit of those hashes is if somehow someone were to attempt a man-in-the-middle attack of a host, the host’s hash/fingerprint value will change and SSH would throw up an even more panicked warning telling you essentially:
“Hey, that host doesn’t seem like who seems to be… Be careful!”
That dialog text you are seeing is just the first connection query that basically says:
“Hey, you have never connected to this host before. Let me confirm you do want to connect and let me save that host’s hash/fingerprint to
/.ssh/known_hostsfrom this moment onwards.”
More information can be found here in this article, “OpenSSH/Client Configuration Files”:
This file is local to the user account and contains the known keys for remote hosts. Often these are collected from the hosts when connecting for the first time, but they can be added manually. As with those keys stored in the global file, /etc/ssh/ssh_known_hosts, these keys are used to verify the identity of the remote host, thus protecting against impersonation or man-in-the-middle attacks. With each subsequent connection the key will be compared to the key provided by the remote server. If there is a match, the connection will proceed. If the match fails, ssh will fail with an error message. If there is no key at all listed for that remote host, then the key's fingerprint will be displayed and there will be the option to automatically add the key to the file. This file can be created and edited manually, but if it does not exist it will be created automatically by ssh when it first connects to a remote host.
Use ssh-keygen -lf to verify key fingerprint by following a tutorial.
You should abandon connection, dump old keys and generate new ones ASAP if fingerprints do not match after verification.
