3

I'm running pscp on Windows from a script. If I add

echo y | pscp.exe...

It works. However, I can't get it to accept the hostkey using

pscp.exe -hostkey aa:bb:cc...

I've also tried

pscp.exe -hostkey "ssh-rsa 2048 aa:bb:cc..."

and this doesn't work either. Every time I get the following error:

Fatal: Host key did not appear in manually configured list

Have I misunderstood how this works? This needs to be completely automated, I can't manually add the key as it gets stored in the user registry context. This script needs to be run as a scheduled task using a service account, potentially on multiple machines.

What is the correct usage of -hostkey?

For the avoidance of doubt yes that's the correct algorithm and key length and yes I'm using the actual fingerprint and not "aa:bb:cc..." which has been used for the example.

Giacomo1968
  • 58,727
Matt G
  • 133

1 Answers1

3

This is the correct usage:

C:\>plink -pw password -hostkey 01:02:03:04:05:06:07:08:09:10:11:12:13:14:15:16 username@hostname

And this works:

C:\>plink -pw password -hostkey "RSA 2048 01:02:03:04:05:06:07:08:09:10:11:12:13:14:15:16" username@hostname

But as @dave_thompson_085 stated... the program seems to ignore any additional space-separated words, because this works also:

C:\>plink -pw password -hostkey "ASDF 01:02:03:04:05:06:07:08:09:10:11:12:13:14:15:16 ASDF" username@hostname

I found that the key must match whatever is expected in the handshake (found by not providing the -Hostkey option):

C:\>plink hostname
The server's host key is not cached in the registry. You
have no guarantee that the server is the computer you
think it is.
The server's rsa2 key fingerprint is:
ssh-rsa 2048 01:02:03:04:05:06:07:08:09:10:11:12:13:14:15:16
If you trust this host, enter "y" to add the key to
PuTTY's cache and carry on connecting.
If you want to carry on connecting just once, without
adding the key to the cache, enter "n".
If you do not trust this host, press Return to abandon the
connection.
Store key in cache? (y/n)

This command will display what keys were generated on the server:

$ ls -1 /etc/ssh/ssh_host_*.pub
/etc/ssh/ssh_host_dsa_key.pub
/etc/ssh/ssh_host_key.pub
/etc/ssh/ssh_host_rsa_key.pub

These commands will display the keyfingerprint (using the filenames displayed from the previous command above):

$ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key
2048 01:02:03:04:05:06:07:08:09:10:11:12:13:14:15:16 /etc/ssh/ssh_host_rsa_key.pub (RSA)
$ ssh-keygen -l -f /etc/ssh/ssh_host_dsa_key
1024 01:02:03:04:05:06:07:08:09:10:11:12:13:14:15:16 /etc/ssh/ssh_host_dsa_key.pub (DSA)
kttii
  • 146
  • 4