1

Is there any way to add known ECDSA fingerprint to known_hosts without trying to log into server or force ssh to show the key and ask me for acceptance?

When I'm trying to log-in for the first time, it just adds the key automatically without showing it which isn't very safe.

  • 1
    You have probably option VerifyHostKeyDNS yes, which verifies the host key with the SSHFP record in DNS and it doesn't bother you with manual checking. – Jakuje Aug 20 '15 at 9:43
1

The contents of known_host is just the contents of the .pub file of the SSH host key, which (in the case of ECDSA) is found in /etc/ssh/ssh_host_ecdsa_key.pub.

In most configurations, SSH should ask you for the host SSH key the first time around; if it doesn't, there are two possibilities:

  1. You have StrictHostKeyChecking set to no. If this is the case, SSH will just add any SSH key to known_hosts, without asking or performing any kind of check. To fix, set this option to yes (ssh won't ask, but will also refuse to connect to host with unknown key) or ask (ssh will ask what to do when confronted with an unknown key; the default)
  2. The administrator of the SSH server has created an SSHFP DNS record for your server and has DNSSEC enabled, your SSH client is able to verify the DNSSEC chain, and the SSHFP fingerprint matches the one your server exports. In this case, the SSH fingerprint is verified, just not through the regular means, and SSH won't bother you with the minutiae of checking that everything is okay.
  • I put "StrictHostKeyChecking ask" into /etc/ssh/ssh_config but nothing changed. It still accepts fingerprint without showing it nor asking. Also I don't have any user-specific configuration file in my ~/.ssh. Strange – ardabro Aug 20 '15 at 10:43
  • It is even more strange: when I call ssh -o StrictHostKeyChecking=ask <hostname> it still doesn't ask for anything – ardabro Aug 20 '15 at 10:50
  • Did you check for sshfp dns records? Maybe clear out your .ssh/authorized_keys and try again with -v; if it does find something in dns, that will tell you. – Wouter Verhelst Aug 21 '15 at 7:59
  • Ok - I know what is going on. I removed it with ssh-keygen -R by IP and it is necessary to remove it by dns.name as well. Thanks! – ardabro Aug 21 '15 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.