How to confirm ssh fingerprint

Question

I work on Windows 10.

I PuTTY ssh into physical:CentOS7, virtualbox:CentOS6,7 & Ubuntu 16.

On 1st ssh FROM Win TO vb:Ubuntu & I get the regular ole server/fingerprint not a known host popup. No big deal. But I wondered: how could I confirm there's no "man in the middle" ?

Simplest case: I'm sitting in front of the target (called 'local' from here on) and check its fingerprint directly.

Turns out: trying to local view the public machine key fingerprint using ssh-keygen -lf <filename> (file: /etc/ssh/ssh_host_rsa_key.pub) on the Ubuntu 16 gave me a fingerprint I couldn't match against any warning from a remote ssh.

By anywhere, I mean that:

1. the string "2048 SHA256:NPAUL **** 4QQ [email protected] (RSA)" is not what appears in the PuTTy popup and

2. when I copy the pub key file to CentOS6 or 7 and run ssh-keygen -l -f against it, they match each other but not the one from running ssh-keygen locally on Ubuntu (like, the implementations differ).

   2a. doing the scp was just a way I thought I might test things out.

The nut of the question is: how can I confirm the fingerprint ssh ui shows me is correct before I tell it 'yes' I'll accept it?

Local view of fingerprint (approx): "2048 SHA256:NPAULv10 **** lic4QQ [email protected] (RSA)"

Remote view of fingerprint (using Win PuTTy): "The new rsa2 key fingerprint is: ssh-rsa 2048 ce:e9:43 **** :cb"

Remote view of fingerprint (using CentOS6&7 terminal): "2048 ce:e9:43 **** :cb" filename (RSA)

Note:

1. The remotely viewed fingerprint has colons in it.
2. The bubblebabble digests (from -B) are match but they aren't fingerprints.
3. local ssh-keygen -lf on /etc/ssh*.pub (i.e.: *dsa_key.pub, *ecdsa_key.pub, *ed25519_key.pub & *rsa_key.pub) didn't output a match for the fingerprint seen remotely either.
4. I've overlookedly something probably, I did check the std man pages, ubuntu docs ... don't know what I'm missing.

Answer 1

Use the -E switch to the ssh-keygen:

ssh-keygen -l -f -E md5

This is available in recent OpenSSH versions and prints the "old" MD5 fingerprint, same as PuTTY.