4

I work on Windows 10.

I PuTTY ssh into physical:CentOS7, virtualbox:CentOS6,7 & Ubuntu 16.

On 1st ssh FROM Win TO vb:Ubuntu & I get the regular ole server/fingerprint not a known host popup. No big deal. But I wondered: how could I confirm there's no "man in the middle" ?

Simplest case: I'm sitting in front of the target (called 'local' from here on) and check its fingerprint directly.

Turns out: trying to local view the public machine key fingerprint using ssh-keygen -lf <filename> (file: /etc/ssh/ssh_host_rsa_key.pub) on the Ubuntu 16 gave me a fingerprint I couldn't match against any warning from a remote ssh.

By anywhere, I mean that:

  1. the string "2048 SHA256:NPAUL **** 4QQ user@example.com (RSA)" is not what appears in the PuTTy popup and
  2. when I copy the pub key file to CentOS6 or 7 and run ssh-keygen -l -f against it, they match each other but not the one from running ssh-keygen locally on Ubuntu (like, the implementations differ).

    2a. doing the scp was just a way I thought I might test things out.

The nut of the question is: how can I confirm the fingerprint ssh ui shows me is correct before I tell it 'yes' I'll accept it?

Local view of fingerprint (approx): "2048 SHA256:NPAULv10 **** lic4QQ user@example.com (RSA)"

Remote view of fingerprint (using Win PuTTy): "The new rsa2 key fingerprint is: ssh-rsa 2048 ce:e9:43 **** :cb"

Remote view of fingerprint (using CentOS6&7 terminal): "2048 ce:e9:43 **** :cb" filename (RSA)

Note:

  1. The remotely viewed fingerprint has colons in it.
  2. The bubblebabble digests (from -B) are match but they aren't fingerprints.
  3. local ssh-keygen -lf on /etc/ssh*.pub (i.e.: *dsa_key.pub, *ecdsa_key.pub, *ed25519_key.pub & *rsa_key.pub) didn't output a match for the fingerprint seen remotely either.
  4. I've overlookedly something probably, I did check the std man pages, ubuntu docs ... don't know what I'm missing.
3

Use the -E switch to the ssh-keygen:

ssh-keygen -l -f -E md5

This is available in recent OpenSSH versions and prints the "old" MD5 fingerprint, same as PuTTY.

  • Thanks a lot! I went over the std man, ubuntu man... I even took a quick look at rfc4716 thinking I might see what I missed but no luck; that md5 looks like magic and the -m wasn't necessary. This one really stumped me. Thanks again! – iletras Nov 7 '16 at 19:51
  • It is claimed in the following article that the -E switch is not available to ssh-keygen before OpenSSH v6.8. See the section: "Displaying fingerprints in other formats" in: phcomp.co.uk/Tutorials/Unix-And-Linux/… – iletras Nov 7 '16 at 23:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.