In sshd(8) man page:
The OpenSSH SSH daemon supports SSH protocol 2 only. Each host has a host-specific key, used to identify the host. Whenever a client connects, the daemon responds with its public host key. The client compares the host key against its own database to verify that it has not changed. Forward secrecy is provided through a Diffie-Hellman key agreement. This key agreement results in a shared session key. The rest of the session is encrypted using a symmetric cipher.
(Emphasized by me)
Can someone explain to me how does the authentication process work? As I understand:
- Each host will have a unique ssh key (public and private)
- When a client connects to a server, the sshd daemon provides the client with a public key
- The client then do something that I don't understand
- After that, the rest of that session is encrypted.
Am I correct? Can someone explain in detail what does The client compares the host key against its own database to verify that it has not changed means?