How to compare different SSH fingerprint (public key hash) formats?
Solution 1
ssh
# ssh -o "FingerprintHash sha256" testhost
The authenticity of host 'testhost (256.257.258.259)' can't be established.
ECDSA key fingerprint is SHA256:pYYzsM9jP1Gwn1K9xXjKL2t0HLrasCxBQdvg/mNkuLg.
# ssh -o "FingerprintHash md5" testhost
The authenticity of host 'testhost (256.257.258.259)' can't be established.
ECDSA key fingerprint is MD5:de:31:72:30:d0:e2:72:5b:5a:1c:b8:39:bf:57:d6:4a.
ssh-keyscan & ssh-keygen
Another approach is to download the public key to a system which supports both MD5 and SHA256 hashes:
# ssh-keyscan testhost >testhost.ssh-keyscan
# cat testhost.ssh-keyscan
testhost ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItb...
testhost ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0U...
testhost ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMKHh...
# ssh-keygen -lf testhost.ssh-keyscan -E sha256
256 SHA256:pYYzsM9jP1Gwn1K9xXjKL2t0HLrasCxBQdvg/mNkuLg testhost (ECDSA)
2048 SHA256:bj+7fjKSRldiv1LXOCTudb6piun2G01LYwq/OMToWSs testhost (RSA)
256 SHA256:hZ4KFg6D+99tO3xRyl5HpA8XymkGuEPDVyoszIw3Uko testhost (ED25519)
# ssh-keygen -lf testhost.ssh-keyscan -E md5
256 MD5:de:31:72:30:d0:e2:72:5b:5a:1c:b8:39:bf:57:d6:4a testhost (ECDSA)
2048 MD5:d5:6b:eb:71:7b:2e:b8:85:7f:e1:56:f3:be:49:3d:2e testhost (RSA)
256 MD5:e6:16:94:b5:16:19:40:41:26:e9:f8:f5:f7:e7:04:03 testhost (ED25519)
Solution 2
Only answering how to view local keys, which is also visible on the other answer but could be missed. On Ubuntu 19.04 version at least, SHA256 is the default format for ssh-keygen:
$ ssh-keygen -lf ~/.ssh/id_rsa.pub
2048 SHA256:CxIuAEc3SZThY9XobrjJIHN61OTItAU0Emz0v/+15wY user@host (RSA)
But you can explicitly specify SHA256 of course:
$ ssh-keygen -lf ~/.ssh/id_rsa.pub -E sha256
If you want to view the MD5 instead:
$ssh-keygen -lf ~/.ssh/id_rsa.pub -E md5
2048 f6:bf:4d:d4:bd:d6:f3:da:29:a3:c3:42:96:26:4a:41 user@host (RSA)
Which, by the way, is the format once used by GitHub on their list of SSH keys on your account. For details: $man ssh-keygen
.
Related videos on Youtube
Ned64
Updated on September 18, 2022Comments
-
Ned64 almost 2 years
When I log in to an SSH server/host I get asked whether the hash of its public key is correct, like this:
# ssh 1.2.3.4 The authenticity of host '[1.2.3.4]:22 ([[1.2.3.4]:22)' can't be established. RSA key fingerprint is SHA256:CxIuAEc3SZThY9XobrjJIHN61OTItAU0Emz0v/+15wY. Are you sure you want to continue connecting (yes/no)? no Host key verification failed.
In order to be able to compare, I used this command on the SSH server previously and saved the results to a file on the client:
# ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub 2048 f6:bf:4d:d4:bd:d6:f3:da:29:a3:c3:42:96:26:4a:41 /etc/ssh/ssh_host_rsa_key.pub (RSA)
For some great reason (no doubt) one of these commands uses a different (newer?) way of displaying the hash, thereby helping man-in-the-middle attackers enormously because it requires a non-trivial conversion to compare these.
How do I compare these two hashes, or better: force one command to use the other's format?
The
-E
option tossh-keygen
is not available on the server.