1
$ ssh 192.168.29.126
The authenticity of host '192.168.29.126 (192.168.29.126)' can't be established.
ECDSA key fingerprint is SHA256:1RG/OFcYAVv57kcP784oaoeHcwjvHDAgtTFBckveoHE.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

What is the "fingerprint" it is asking for?

1

2 Answers 2

5

The question asks whether you trust and want to continue connecting to the host that SSH does not recognise. It gives you several ways of answering:

  • yes, you trust the host and want to continue connecting to it.
  • no, you do not trust the host, and you do not want to continue connecting to it.
  • [fingerprint] means that you may paste in the fingerprint, i.e. the hash of the host's key, as the reply to the question. If the pasted fingerprint is the same as the host's fingerprint (as discovered by SSH), then the connection continues; otherwise, it's terminated.

The fingerprint that answers the question in the affirmative is the exact string shown in the actual question (SHA256:1RG/OFcYAVv57kcP784oaoeHcwjvHDAgtTFBckveoHE in your case). If you have stored this fingerprint elsewhere, it's easier to paste it in from there than to compare the long string by eye.

In short: The third answer alternative provides a convenient way to verify that the fingerprint for the host is what you think it should be.


Using the fingerprint to answer the question was introduced in OpenSSH 8.0 (in 2019).

The commit message reads

Accept the host key fingerprint as a synonym for "yes" when accepting an unknown host key. This allows you to paste a fingerprint obtained out of band into the yes/no prompt and have the client do the comparison for you. ok markus@ djm@

1

On a very abstract user level: the fingerprint is derived from the server's encryption key pair, and the intention is that you have some other, trusted, channel of communication to verify the expected value, which makes you somewhat confident you're actually talking to the server you want to talk to. (I.e., you call the systems helpdesk and ask them "please read out to me the fingerprint I'm supposed to see" and they'll likely tell you you're the first person ever to ask them that and they'll have to find out how to do it. Sufficiently new versions of openssh can look at special DNS records for the fingerprint, the hope being that somebody who can divert your SSH connection cannot divert or forge the DNS lookup.)

Or do you mean: how is the fingerprint actually derived?

2
  • Thank you so much for this wonderful answer you can tell me how it is derived would love to know thankyou
    – john stark
    Commented Apr 28, 2022 at 6:12
  • Are there any other tools & technology which uses this "fingerprint file" concept?
    – john stark
    Commented Apr 28, 2022 at 6:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .