3

In Debian you can set up an alioth account. Once you have set up the things, you need to authenticate yourself to Debian. You add your ssh keys via https://wiki.debian.org/Alioth/SSH

All this is fine. Debian also shares its public SSH keys here

Now when you try to connect to the site via ssh I get this 256 SHA RSA fingerprint - VbwoMdcyFWByMDQrIOcaUL6c16LV6+80G9+Rs2rtA8E . Now this may be correct, this might not be correct there is no way to say either way because I'm unable to read the remote URL. I did look at: How to get ssh server fingerprint information , and hence tried :

─[$] ssh-keygen -lf https://db.debian.org/machines.cgi\?host\=moszumanska                                                            [0:44:45]
ssh-keygen: https://db.debian.org/machines.cgi?host=moszumanska: No such file or directory

Any ideas what am I doing wrong here ?

Improve this question
1
  • 1
    I think you may want to try running ssh-keyscan first. e.g. ssh-keyscan <hostname> > keyscan.txt followed by ssh-keygen -lf keyscan.txt will show you the information you're looking for.
    – SauceCode
    Commented Mar 7, 2017 at 19:17

1 Answer 1

Reset to default
8

SSH host key

The ssh-keyscan command is what you need for the host key. It was developed so that users can obtain public host keys without needing to authenticate to the SSH server. From its man page:

ssh-keyscan is a utility for gathering the public ssh host keys of a number of hosts. It was designed to aid in building and verifying ssh_known_hosts files.

For your particular example, the output of ssh-keyscan moszumanska.debian.org is

# moszumanska.debian.org:22 SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u6
moszumanska.debian.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzHN3B7CPXopYu0uswB5NKyro/I88Sgdui4UC80+x6FniylXtRDWSf+psaMAdgqrKHyV/TSWwcgc+Vrh+Us07wBwdOhHUBiPrEh/04KSbijguZHiQeQQWDD0xC+zOJ9Woa6WH+WZARE5aWd3YEupaII7VRG6e3sxUHmMpTMgc19/voPNUqNzrdqKQNKKc1JGKxM4B/7JRmVNHeclNRyXPJKSUSMpe4+g9ldMssKiY8foFFPFA8gQ3oIjIAr/pALm2q4JLpsVoJy/JonkgkjO8iRfklqyTVLrXTaBc0isrVR4pGZ1QFbucJ5LO5rdxPwc1rxcBxK9clhsuUaLz8fv5n
# moszumanska.debian.org:22 SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u6

This corresponds with the published SSH host key.

SSH host key fingerprint

The ssh-keygen command can then be used to get the fingerprint. I’ve previously written a detailed answer on how both these commands can be combined.

$ ssh-keygen -lf <(ssh-keyscan moszumanska.debian.org 2>/dev/null)
2048 SHA256:VbwoMdcyFWByMDQrIOcaUL6c16LV6+80G9+Rs2rtA8E moszumanska.debian.org (RSA)
Improve this answer
2
  • 2
    Note that 'published' or otherwise obtained by authenticated means, here https, is vital. Otherwise ssh-keyscan can give you a key, and ssh-keygen a fingerprint for that key, that is in fact an impostor.
    – dave_thompson_085
    Commented Mar 7, 2017 at 21:56
  • @dave_thompson_085 Very true. I think it's great that Debian publish the server keys so users can mitigate MITM attacks.
    – Anthony Geoghegan
    Commented Mar 7, 2017 at 22:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .