0

I have this strange situation with host-key checking. ssh -v github.com:

  • works with "OpenSSH_7.9p1, LibreSSL 2.7.3" on MacOS Mojave (10.14.5 (18F132)):
    debug1: Server host key: ssh-rsa 
    SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8
    debug1: Host 'github.com' is known and matches the RSA host key.
    debug1: Found key in /Users/dominik/.ssh/known_hosts:1
    
    I then get asked for the passphrase.
  • does not work with "OpenSSH_7.9p1 Debian-10, OpenSSL 1.1.1c 28 May 2019" on Docker image debian:buster-20190708:
    debug1: Server host key: ssh-rsa SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8
    The authenticity of host 'github.com (140.82.118.4)' can't be established.
    RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.
    Are you sure you want to continue connecting (yes/no)?
    

My ~/.ssh/known_hosts file:

github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==

The Docker command I used is: docker run --rm -it -v ~/.ssh/:/root/.ssh/ debian:buster-20190708 sh -c 'apt-get update && apt-get install -y ssh && ssh -v github.com'

3
  • I don't see a problem? Just run the command: ssh-keyscan -H github.com >> ~/.ssh/known_hosts on your debian machine.
    – notStan
    Aug 2 '19 at 18:54
  • @notStan I want to use the known_host from my host machine as I've already checked that host's fingerprint. That's why I've included it in the Docker container -v ~/.ssh/:/root/.ssh/. Does that work for you?
    – Dominik
    Aug 5 '19 at 14:06
  • 1
    @notStan Thanks for your hint. I've found the answer now.
    – Dominik
    Aug 5 '19 at 14:24
1

I've found the answer:

Run ssh-keyscan -H, as @notStan mentioned in his comment, on the host machine. It hashes all hostnames in known_hosts (the original is backed up in known_hosts.old).

Debian's default OpenSSH config in /etc/ssh/ssh_config sets the option HashKnownHosts yes. It then seems to not read unhashed hostnames, in this case github.com.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.