2

If I try this

ssh jh@jh-System-Product-Name

Works fine.

Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.10.0-40-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

On the other hand

ssh localhost
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:gsLR5X+7Im1MdPch7u8Jlvm0ql6PH0rDBsWnpOpizd4.
Are you sure you want to continue connecting (yes/no)? no

What does this mean?

5

Short Answer

It means either/or:

  • you've never connected to the local system via ssh.
  • new host keys have been generated on your system.

Longer Answer to include information from the comments

SSH is a Trust On First Use (TOFU) system. This means that the connecting system has a list of known hosts that it will always trust. If a previously unknown remote connection is made, the remote system's host key is presented for the connecting user to inspect and accept or reject. If the new host is accepted, that host key gets added to the local list of known hosts that is always trusted.

This is SSH's most vulnerable area. DNS lookups are unsecured for most domains unless DNSSEC is deployed. So, there is a possibility of an attacker spoofing DNS to look like the remote system. In this case, the host key would not match, but many users don't bother to check the host keys anyway. So, if using SSH with password authentication, a remote attacker can Man-In-The-Middle (MITM) an SSH connection and intercept your username and password if the host keys are incorrect and the connecting user doesn't bother to check.

There is a mitigating DNS record called sshfp, which stands for SSH Fingerprint. The sshfp record is entered by the domain owner in the DNS zone file. A connecting system to the domain checks for sshfp records. If a record is found, the fingerprint is verified. This prevents a connecting system from connecting to the incorrect remote host in the TOFU trust model. However, many, maybe most, DNS providers do not support the sshfp record type. And so, most ssh connections are not protected against DNS spoofing.

So, be careful when connecting to a remote system that you have connected to previously but presents a new host key. Your concerned response is good. However, in this case, most likely unwarranted.

  • Generated by whom,by me? – MikiBelavista Dec 6 '17 at 13:02
  • ssh keeps a list of known hosts... I get the same error, because I don't use ssh to connect to localhost ... there's generally no reason to do that. – RubberStamp Dec 6 '17 at 13:04
  • @MikiBelavista, generated by whoever manages the system, possibly you. However, in all likelikhood the issue is the first bullet point: you've never done this before. ssh by default issues this warning the first time you connect to any hostname, and this is likely the first time you connected to localhost from that machine. – user4556274 Dec 6 '17 at 13:07
  • @user4556274 Desktops is mine,so I am admin. – MikiBelavista Dec 6 '17 at 13:09
  • @RubberStamp Can I see somehow list of a known hosts? – MikiBelavista Dec 6 '17 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.