Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had thought about this and my host provides out of band support, so I could simply create the key fingerprint out of band and compare it when connecting to that server from home.

Is there any other way other than out of band access where you can verify the host you are connecting to is indeed the server that you have purchased?

How is this done in practise?

share|improve this question
Anyone know this? – James l. Dec 24 '10 at 3:03
up vote 4 down vote accepted

If I understand you correctly, you are asking whether there are any means---aside from out-of-band channels---to securely retrieve your ssh server's public key fingerprint. Strictly speaking, the answer must be no, since, theoretically, a man-in-the-middle (MITM) could set up a bogus ssh server that allows you to "login" regardless of the credentials you supply. If you didn't know the public key fingerprint of your real server ahead of time, you would have no way of knowing that the fake server's fingerprint was not that of your real server.

In practice, most people assume (and justifiably so, in most cases) that the odds of a MITM actually spoofing them is very low, and so they simply accept that the server key fingerprint presented to them when connecting for the first time is that of their real ssh server, and not that of a fake.

Of course, as you make many ssh connections to your server over time, the odds of seeing a MITM attempt to spoof you will accumulate. Fortunately, for every connection you make after the first one, the server's public key will be stored in your known_hosts file. And so, if a MITM ever does attempt some shenanigans during any particular connection attempt (after the first one), your ssh client will immediately alert you to the fact that the server key just received does not match the one expected, and the connection will be aborted.

In conclusion, if you have out-of-band means of knowing your server's key, then you ought to use it to verify the key when you make that first connection which updates your known_hosts file. But even if you don't have such means, although there is a theoretical security risk, the risk is probably very small.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.