Fingerprint Verification

Out-of-band verification, the right way

The first SSH connection to a host shows you a fingerprint and asks if you trust it. The textbook-ideal flow:

Get the server's fingerprint through a different, trusted channel — physical access, the cloud provider's console, a Slack message from the admin who set it up.
Connect via SSH. Compare the fingerprint shown to the one you have.
If they match, type yes. If not, stop.

How to read a fingerprint off the server

On the server itself, the host keys live in /etc/ssh/. Each key type (ed25519, RSA, ECDSA) has its own pair. ssh-keygen -lf prints the fingerprint of any key file. From a remote vantage point, ssh-keyscan grabs the public host key over the network — useful for pre-populating known_hosts.

The pragmatic middle

For a home LAN behind your own router, TOFU on first connection is fine. The threat model — that someone is on your LAN actively MITMing the very first SSH from your laptop to your office Mac — is real but small for most home setups. For a brand-new cloud VM, take the extra 60 seconds and verify against the provider's console.

Code

Read fingerprints — both sides·bash

# On the server itself, all host key fingerprints
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub
ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub

# From a remote machine — grab via the network
ssh-keyscan -H 192.168.1.100 2>/dev/null | ssh-keygen -lf -

# Pre-populate known_hosts so the first interactive connection has no prompt
ssh-keyscan -H 192.168.1.100 >> ~/.ssh/known_hosts

Exercise

On any machine you have shell access to, print all three host key fingerprints with ssh-keygen -lf. Note them. From your laptop, run ssh-keyscan -H that-host 2>/dev/null | ssh-keygen -lf - and confirm they match. This is the round-trip you'd do to verify a server before accepting its fingerprint for real.