SSH key fingerprints don't match

up vote
2
down vote

favorite

I'm trying to SSH from my laptop into my desktop. On the desktop, ssh-keygen -lf ~/.ssh/id_ecdsa.pub yields 08:ac:cb:9c:e8:c2:4f:2c:1d:6e:54:ad:83:c7:27:47, but when I try to connect, I'm told the ECDSA key fingerprint is something completely different.

I can connect to the machine through HTTP, so I know it's the right one. I'm worried someone is trying to MITM me.

edited Nov 21 at 0:37

Basil Bourque

158210

asked Sep 10 '15 at 19:41

Functino

1244

add a comment |

up vote
2
down vote

favorite

I can connect to the machine through HTTP, so I know it's the right one. I'm worried someone is trying to MITM me.

edited Nov 21 at 0:37

Basil Bourque

158210

asked Sep 10 '15 at 19:41

Functino

1244

add a comment |

up vote
2
down vote

favorite

I can connect to the machine through HTTP, so I know it's the right one. I'm worried someone is trying to MITM me.

edited Nov 21 at 0:37

Basil Bourque

158210

asked Sep 10 '15 at 19:41

Functino

1244

I can connect to the machine through HTTP, so I know it's the right one. I'm worried someone is trying to MITM me.

ssh encryption

edited Nov 21 at 0:37

Basil Bourque

158210

asked Sep 10 '15 at 19:41

Functino

1244

edited Nov 21 at 0:37

Basil Bourque

158210

asked Sep 10 '15 at 19:41

Functino

1244

edited Nov 21 at 0:37

Basil Bourque

158210

edited Nov 21 at 0:37

Basil Bourque

158210

edited Nov 21 at 0:37

Basil Bourque

158210

asked Sep 10 '15 at 19:41

Functino

1244

asked Sep 10 '15 at 19:41

Functino

1244

asked Sep 10 '15 at 19:41

Functino

1244

add a comment |

1 Answer
1

active

oldest

votes

up vote
4
down vote

accepted

It tells you more than what you present here. You need to understand difference between server host key and your client identity key:

This is fingerprint of your local client identity key:
```
ssh-keygen -lf ~/.ssh/id_ecdsa.pub
```

By calling ssh remotehost you are prompted to verify server host key, which is stored on server and you or somebody with access to the server can create you the same fingerprint by executing
```
ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub
```

These two fingerprints will never match.

This can be found in man sshd.

edited Sep 11 '15 at 2:48

Functino

1244

answered Sep 10 '15 at 19:49

Jakuje

7,10251828

add a comment |

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f971236%2fssh-key-fingerprints-dont-match%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
4
down vote

accepted

It tells you more than what you present here. You need to understand difference between server host key and your client identity key:

This is fingerprint of your local client identity key:
```
ssh-keygen -lf ~/.ssh/id_ecdsa.pub
```

By calling ssh remotehost you are prompted to verify server host key, which is stored on server and you or somebody with access to the server can create you the same fingerprint by executing
```
ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub
```

These two fingerprints will never match.

This can be found in man sshd.

edited Sep 11 '15 at 2:48

Functino

1244

answered Sep 10 '15 at 19:49

Jakuje

7,10251828

add a comment |

up vote
4
down vote

accepted

It tells you more than what you present here. You need to understand difference between server host key and your client identity key:

This is fingerprint of your local client identity key:
```
ssh-keygen -lf ~/.ssh/id_ecdsa.pub
```

By calling ssh remotehost you are prompted to verify server host key, which is stored on server and you or somebody with access to the server can create you the same fingerprint by executing
```
ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub
```

These two fingerprints will never match.

This can be found in man sshd.

edited Sep 11 '15 at 2:48

Functino

1244

answered Sep 10 '15 at 19:49

Jakuje

7,10251828

add a comment |

up vote
4
down vote

accepted

It tells you more than what you present here. You need to understand difference between server host key and your client identity key:

This is fingerprint of your local client identity key:
```
ssh-keygen -lf ~/.ssh/id_ecdsa.pub
```

By calling ssh remotehost you are prompted to verify server host key, which is stored on server and you or somebody with access to the server can create you the same fingerprint by executing
```
ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub
```

These two fingerprints will never match.

This can be found in man sshd.

edited Sep 11 '15 at 2:48

Functino

1244

answered Sep 10 '15 at 19:49

Jakuje

7,10251828

It tells you more than what you present here. You need to understand difference between server host key and your client identity key:

This is fingerprint of your local client identity key:
```
ssh-keygen -lf ~/.ssh/id_ecdsa.pub
```

By calling ssh remotehost you are prompted to verify server host key, which is stored on server and you or somebody with access to the server can create you the same fingerprint by executing
```
ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub
```

These two fingerprints will never match.

This can be found in man sshd.

edited Sep 11 '15 at 2:48

Functino

1244

answered Sep 10 '15 at 19:49

Jakuje

7,10251828

edited Sep 11 '15 at 2:48

Functino

1244

edited Sep 11 '15 at 2:48

Functino

1244

edited Sep 11 '15 at 2:48

Functino

1244

answered Sep 10 '15 at 19:49

Jakuje

7,10251828

answered Sep 10 '15 at 19:49

Jakuje

7,10251828

answered Sep 10 '15 at 19:49

Jakuje

7,10251828

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Super User!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

Some of your past answers have not been well-received, and you're in danger of being blocked from answering.

Please pay close attention to the following guidance:

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Gfrktyl