bk99.de entertain the web since 1997

bk99.de
Hostblogger · SSHCurated

Checking ECDSA and Ed25519 host keys before the first SSH login

Summary

Manuel Schmitt adds ECDSA and Ed25519 host keys for comparison to the setup and reinstallation emails for root servers. From September 2015, new root server customers received ECDSA and Ed25519 host keys. This also applied after a reinstallation.

Ideas

  • Host keys known in advance make the first SSH connection verifiable.
  • Several modern key types take different client capabilities into account.
  • A reinstallation changes the server identity and requires new fingerprints.

Insights

  • Trust on first use becomes more robust when a second trustworthy channel delivers the key.
  • Automated provisioning should treat server identity just like credentials.

Facts

  • The keys were provided explicitly for comparison when connecting.

Recommendations

  • Compare the fingerprint before confirming a new SSH host.
  • Only remove old known_hosts entries after a verified reinstallation.

References

Read the original article on Hostblogger

Search the Web Archive

Hostblogger · 2007

Shared hosting SSH with public key authentication only

Manuel Schmitt describes switching off password-based SSH logins on shared hosting servers in favour of mandatory public keys. SSH was included free of charge in the web hosting packages. Since 23 October 2007, password logins on the shared hosting servers had been disabled.

Hackaday · 2019

SSH can do much more than open terminals

Al Williams shows SSH configuration, file transfer, port forwarding, a SOCKS proxy and remote file systems as versatile tools for secure networks. SSH encrypts login and data traffic. scp and sftp transfer files over SSH.