2

I'm trying to SSH to my server, and the client is asking about the authenticity of the host.

ECDSA key fingerprint is SHA256:bla bla bla

With every version of OpenSSH I've used, ECDSA (or RSA) keys were shown something like

a7:3h:75:5d:si:9v:3g...

On Ubuntu 16.04 they're being shown like

c2ymd4uGIG3y34R78BcrykBVT...

I have another way to access the server, and I'm trying to verify the fingerprint by running ssh-keygen -lf ssh_host_ecdsa_key.pub. But this outputs something like 2048 a7:3h:75:5d:si:9v:3g.... Even ignoring the colons, they don't match. I can't be 100% positive this isn't because of a MITM attack, but it's highly unlikely.

How can I verify the key signatures? All the solutions I've found seem to deal with a different version of ssh-keygen, though I can't figure out what version I have, or what others have.

Improve this question

2 Answers 2

Reset to default
3

You can use ssh -o FingerprintHash=md5 user@host to use old-school MD5 hashes, or store this in your ~/.ssh/config:

FingerprintHash md5

You server is probably using old openssh version which does not support new sha256 hashses.

Improve this answer
6
  • Server is 14.04. From what I had read any server using MD5 for SSH key fingerprints must be quite old and not updated, so I thought that must not be it (I think I haven't been doing dist-upgrade). In the command ssh -O FingerprintHash=md5 host, by host do you mean user@host? Otherwise I'm missing something. And I just added FingerprintHash md5 to the config file, restarted SSH, and it worked fine.
    – Nateowami
    Jun 28, 2016 at 12:28
  • If you connect to the host with ssh user@host, then yes.
    – Jakuje
    Jun 28, 2016 at 12:33
  • For ssh-copy-id it's -o (lowercase). Perhaps OpenSSH uses the lowercase for this option, in its family of programs? I don't know of every OpenSSH command, but I'm guessing they're consistent.
    – Nateowami
    Aug 30, 2016 at 7:50
  • Yes, it is lowercase for both ssh and ssh-copy-id. Sorry, it was a typo.
    – Jakuje
    Aug 30, 2016 at 7:52
  • I suspected, but didn't want to jump to conclusions. :)
    – Nateowami
    Aug 30, 2016 at 7:55
1

While the accepted answer solves the problem of forcing newer clients to show MD5 hashes, it doesn't specifically solve the problem of forcing a server to show its fingerprint with a specific hash function when calculating fingerprints on the server. To clarify that a bit, when checking fingerprints, you need to match the one shown on the client to the true value on the server. @Jakuje's answer deals with getting the client to use a different hash function, this answer deals with getting the server to show you the hash using a different hash function. It doesn't matter whether you change the server or the client's hash function, just so they're the same.

To find a host's fingerprint, on that host execute:

# Works with the version of OpenSSH on 16.04 but not 14.04
# (on 14.04 I have OpenSSH_6.6.1p1; on 16.04 it's OpenSSH_7.2p2)
# Check your version with with `ssh -V`
cd /etc/ssh
ssh-keygen -l -E md5 -f ssh_host_ecdsa_key.pub

Of course, you can change md5 to any supported hash function, and you may need to change ssh_host_ecdsa_key.pub depending on the key type you're using (e.g. ssh_host_rsa_key.pub).

Improve this answer
1
  • this assumes you have access to the host, no?
    – Michael
    Apr 20, 2022 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.