Check and verify SSH fingerprints

Link copied

Attach video time

Once you connect to a remote host over SSH, its host key is added to the known_hosts file in the .ssh directory of your home directory. This file keeps a record of remote servers you have connected to so SSH can verify that you are connecting to the same server in the future, rather than a faker impersonating it.

A host mismatch can occur when a new machine receives an IP address that you previously used for a different server. The new server has a different fingerprint, so it does not match the key saved in your local known_hosts file.

First, connect to the remote host:

ssh [email protected]

On the remote host, use ssh-keygen to display the fingerprint of its public host key:

ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub

The -l option tells ssh-keygen to display the fingerprint, and -f specifies the file containing the public key. /etc/ssh/ssh_host_ecdsa_key.pub is the typical location for this key on a Linux server.

Note the fingerprint that the command outputs. Then leave the remote host:

exit

On your local machine, remove the existing keys for the host from your known_hosts file:

ssh-keygen -R example.com

You can provide an IP address instead of a hostname:

ssh-keygen -R 203.0.113.10

The -R option removes all keys belonging to the specified host from your local known_hosts file.

Connect to the host again:

ssh [email protected]

SSH now asks you to confirm the connection and displays the remote host's fingerprint. Compare this fingerprint with the one you recorded from the remote host. Only confirm the connection when the fingerprints match and you have verified that you are connecting to the intended server.