2

I'm trying to SSH to my server, and the client is asking about the authenticity of the host.

ECDSA key fingerprint is SHA256:bla bla bla

With every version of OpenSSH I've used, ECDSA (or RSA) keys were shown something like

a7:3h:75:5d:si:9v:3g...

On Ubuntu 16.04 they're being shown like

c2ymd4uGIG3y34R78BcrykBVT...

I have another way to access the server, and I'm trying to verify the fingerprint by running ssh-keygen -lf ssh_host_ecdsa_key.pub. But this outputs something like 2048 a7:3h:75:5d:si:9v:3g.... Even ignoring the colons, they don't match. I can't be 100% positive this isn't because of a MITM attack, but it's highly unlikely.

How can I verify the key signatures? All the solutions I've found seem to deal with a different version of ssh-keygen, though I can't figure out what version I have, or what others have.

2 Answers 2

3

You can use ssh -o FingerprintHash=md5 user@host to use old-school MD5 hashes, or store this in your ~/.ssh/config:

FingerprintHash md5

You server is probably using old openssh version which does not support new sha256 hashses.

6
  • Server is 14.04. From what I had read any server using MD5 for SSH key fingerprints must be quite old and not updated, so I thought that must not be it (I think I haven't been doing dist-upgrade). In the command ssh -O FingerprintHash=md5 host, by host do you mean user@host? Otherwise I'm missing something. And I just added FingerprintHash md5 to the config file, restarted SSH, and it worked fine.
    – Nateowami
    Commented Jun 28, 2016 at 12:28
  • If you connect to the host with ssh user@host, then yes.
    – Jakuje
    Commented Jun 28, 2016 at 12:33
  • For ssh-copy-id it's -o (lowercase). Perhaps OpenSSH uses the lowercase for this option, in its family of programs? I don't know of every OpenSSH command, but I'm guessing they're consistent.
    – Nateowami
    Commented Aug 30, 2016 at 7:50
  • Yes, it is lowercase for both ssh and ssh-copy-id. Sorry, it was a typo.
    – Jakuje
    Commented Aug 30, 2016 at 7:52
  • I suspected, but didn't want to jump to conclusions. :)
    – Nateowami
    Commented Aug 30, 2016 at 7:55
1

While the accepted answer solves the problem of forcing newer clients to show MD5 hashes, it doesn't specifically solve the problem of forcing a server to show its fingerprint with a specific hash function when calculating fingerprints on the server. To clarify that a bit, when checking fingerprints, you need to match the one shown on the client to the true value on the server. @Jakuje's answer deals with getting the client to use a different hash function, this answer deals with getting the server to show you the hash using a different hash function. It doesn't matter whether you change the server or the client's hash function, just so they're the same.

To find a host's fingerprint, on that host execute:

# Works with the version of OpenSSH on 16.04 but not 14.04
# (on 14.04 I have OpenSSH_6.6.1p1; on 16.04 it's OpenSSH_7.2p2)
# Check your version with with `ssh -V`
cd /etc/ssh
ssh-keygen -l -E md5 -f ssh_host_ecdsa_key.pub

Of course, you can change md5 to any supported hash function, and you may need to change ssh_host_ecdsa_key.pub depending on the key type you're using (e.g. ssh_host_rsa_key.pub).

1
  • this assumes you have access to the host, no?
    – Michael
    Commented Apr 20, 2022 at 20:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .