Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
At my new hosting provider, they allowed SSH for my account, but they only sent me port, server address, username, password, but no key.
When I try to log in with PuTTY, it logs in, but I get the warning that you can see on the screenshot. I can skip the message and proceed, and then PuTTY does log in and I can do my job. I want to use SSH to upload my database. Is it safe to use it this way, or I should skip this hosting and choose another one?
This warning is normal when you connect via SSH for the first time to a server. SSH doesn't know yet the public key of the server, so it is prompting you whether it should consider it valid or not. Unless you have reasons to suspect your connection is intercepted or you're connecting to the wrong server, you can safely accept it. You can also ask your hosting provider to confirm the public key of the server, but this seems overkill to me.
The following times you connect to the same server, SSH will check its public key to ensure its identity and warn you if the key has changed, as it could mean a MITM attack. (In practice, more often it just means that the sysadmin has generated a new key pair for the server.)
Also, note that it is normal that your ISP has not given you a key; if you want to set up pubkey authentication (and remove password-based authentication, which is a good idea) you should do this yourself, by generating a key pair. In this way you'll be the sole owner of the private key.
SSH uses host keys to authenticate a specific computer in order to ensure that you are not victim of a man-in-the-middle-attack. The host key is usually auto-generated when SSH is installed on a computer, and hence can change if the computer is re-installed (or for some reason the administrator changed it via ssh-keygen) .
An SSH client will create a local database of "known" remote hosts where it stores which SSH host key belongs to which computer, where the computer is identified either by its FQDN or the IP address. In Linux, this is usually the file .ssh/known_hosts in your user's home directory; under Windows, PuTTY will store it in a registry key. If, upon contact, the host key presented by the remote host does not match the entry in the local database, the SSH client will issue a warning so that you can decide whether you want to continue contacting that computer or not (e.g. because you suspect a man-in-the-middle attack).
Now, upon first contact, the host key of the remote host is not yet stored in your local database. So the client cannot know whether that computer is actually "the right one". It may very well be, so it presents you with an option to trust the key presented and store it as the authoritative authentication for that computer for all further connections (If you trust this host ...). If you know that the host key, as identified by its fingerprint, does correspond to the computer you want to connect to, you can click "Yes" and store the host key in your local database. For all further connections, the SSH client will then check that the host key is still the same, and if it is, no warning will be issued anymore.
The only way to actually "be sure" if the host key is the right one is to contact the hosting provider and ask them to tell you the fingerprint of the computer's host key.
As noted by @Ginnungagap in a comment, there are ways to "publish" SSH host keys like SSHFP records or SSH host certificates, but PuTTY has only recently added support for certificates, and not yet for SSHFP.
