I always find that I get this message when I ssh into a new machine:
12:f8:7e:78:61:b4:bf:e2:de:24:15:96:4e:d4:72:53
What does it stand for? Will every machine have the same fingerprint every time?
How are these fingerprints generated? What parameters do they depend on?
You can generate a fingerprint for a public key using ssh-keygen like so:
ssh-keygen -lf /path/to/key.pub
Concrete example (if you use an RSA public key):
$ ssh-keygen -lf ~/.ssh/id_rsa.pub
2048 00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff /Users/username/.ssh/id_rsa.pub (RSA)
The first part (2048) is the key length in bits, second part (00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff) is the fingerprint of the public key and the third part is location of the public key file itself.
In newer versions of OpenSSH, Base64 encoded SHA-256 is shown instead of hexadecimal MD5. To show the legacy style hash, use
$ ssh-keygen -l -E md5 -f ~/.ssh/id_rsa.pub
The fingerprint is based on the host's public key, usually based on
the /etc/ssh/ssh_host_rsa_key.pub file.
Generally it's for easy identification/verification
of the host you are connecting to.
You can view the contents of the file by running cat /etc/ssh/ssh_host_rsa_key.pub . To view that public key in fingerprint format, run ssh-keygen -lvf /etc/ssh/ssh_host_rsa_key.pub.
If the fingerprint changes, the machine you are connecting to has changed their public key. This may not be a bad thing (happens from re-installing ssh), but it could also indicate that you are connecting to a different machine at the same domain/IP (happens when you are connecting through something like a load balancer) or that you are being targeted with a man-in-the-middle attack, where the attacker is somehow intercepting/rerouting your ssh connection to connect to a different host which could be snooping your username/password.
Bottom line: if you get warned of a changed fingerprint, be cautious and double check that you're actually connecting to the correct host over a secure connection. Though most of the time this is harmless, it can be an indication of a potential issue.
See: http://www.lysium.de/blog/index.php?/archives/186-How-to-get-ssh-server-fingerprint-information.html
and: http://en.wikipedia.org/wiki/Public_key_fingerprint
The fingerprint is the MD5 over the binary data within the Base64-encoded public key.
$ ssh-keygen -f foo
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in foo.
Your public key has been saved in foo.pub.
The key fingerprint is:
65:30:38:96:35:56:4f:64:64:e8:e3:a4:7d:59:3e:19 andrew@localhost
The key's randomart image is:
+--[ RSA 2048]----+
| +*..+* |
| =. +.= |
| . . .o . |
| o+ E |
| S= . + o |
| . o o + |
| . . |
| |
| |
+-----------------+
$ cat foo.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDEbKq5U57fhzQ3SBbs3NVmgY2ouYZfPhc6cXBNEFpRT3T100fnbkYw+EHi76nwsp+uGxk08kh4GG881DrgotptrJj2dJxXpWp/SFdVu5S9fFU6l6dCTC9IBYYCCV8PvXbBZ3oDZyyyJT7/vXSaUdbk3x9MeNlYrgItm2KY6MdHYEg8R994Sspn1sE4Ydey5DfG/WNWVrzFCI0sWI3yj4zuCcUXFz9sEG8fIYikD9rNuohiMenWjkj6oLTwZGVW2q4wRL0051XBkmfnPD/H6gqOML9MbZQ8D6/+az0yF9oD61SkifhBNBRRNaIab/Np7XD61siR8zNMG/vCKjFGICnp andrew@localhost
$ echo 'AAAAB3NzaC1yc2EAAAADAQABAAABAQDEbKq5U57fhzQ3SBbs3NVmgY2ouYZfPhc6cXBNEFpRT3T100fnbkYw+EHi76nwsp+uGxk08kh4GG881DrgotptrJj2dJxXpWp/SFdVu5S9fFU6l6dCTC9IBYYCCV8PvXbBZ3oDZyyyJT7/vXSaUdbk3x9MeNlYrgItm2KY6MdHYEg8R994Sspn1sE4Ydey5DfG/WNWVrzFCI0sWI3yj4zuCcUXFz9sEG8fIYikD9rNuohiMenWjkj6oLTwZGVW2q4wRL0051XBkmfnPD/H6gqOML9MbZQ8D6/+az0yF9oD61SkifhBNBRRNaIab/Np7XD61siR8zNMG/vCKjFGICnp' \
| base64 -D | md5
6530389635564f6464e8e3a47d593e19
The md5sum 6530389635564f6464e8e3a47d593e19 is the fingerprint displayed when the key is generated, only without the separating colons.
However, if you’re dealing with the fingerprints that Amazon shows in the EC2 Key Pairs console, unfortunately that may be a different beast. If it’s a 32-digit hex string, it’s the standard MD5 SSH public key fingerprint above. But if it’s 40 hex digits, it’s actually a fingerprint computed by taking the SHA1 of the private key in PKCS#8 format:
$ openssl pkcs8 -in foo -nocrypt -topk8 -outform DER | openssl sha1 -c
e2:77:39:d3:53:a7:62:68:5f:da:82:0e:99:61:30:64:a2:88:c4:58
If you want to check an SSH key file to see if it is the same as what is reported as the "Deploy key" by github, this is for you...
From the private URL: https://github.com/<username>/<repo_name>/settings/keys you will see
At the terminal:
$ ls -l id*
-rw------- 1 bruno staff 1675 Mar 29 17:03 id_rsa
-rw-r--r-- 1 bruno staff 416 Mar 29 17:03 id_rsa.pub
$ ssh-keygen -E md5 -lf id_rsa
2048 MD5:07:b4:00:a4:65:ef:44:89:05:84:60:0c:c9:b2:36:5e ec2-user@ip-10-2-1-16.ec2.internal (RSA)
$ ssh-keygen -E md5 -lf id_rsa.pub
2048 MD5:07:b4:00:a4:65:ef:44:89:05:84:60:0c:c9:b2:36:5e ec2-user@ip-10-2-1-16.ec2.internal (RSA)
You will notice that you get the same fingerprint for both the private and public keys.
That same command can be combined with a neat feature of GitHub, which is the fact that they publicly serve users' SSH public keys at https://github.com/<username>.keys
Here is a one-liner you can use to take advantage of it.
$ curl -sL https://github.com/RichardBronosky.keys | while read; do echo -e "\nkey #$((++i)):"; ssh-keygen -E md5 -lf - <<<"$REPLY"; echo $REPLY; done
key #1:
2048 MD5:07:b4:00:a4:65:ef:44:89:05:84:60:0c:c9:b2:36:5e no comment (RSA)
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJGT35gvsFveu+80qgurrLHId0h55E9jliM7Fo0mV9b7eg3EfyagkAcJUSMFkoov3HY4CW0yzOc7WlN57ABwvpRz1ioFDex0n0FkjoSEs5ROeT1OneRK6Bf6XnplgPuQ/LSSkv3kmK6I29R+YWi6TjDvLLoA5BrXJjOMfUv36jxWCDtk/5ZdhMZqhsMuDm06Jg5JBu6n5jQaZkmaIaunz7vOfwVG9LoCI+MYyIdo2S4VTva7Ee7jfAvgSUUgHTjhzsPO0/Ww5a/Kz2ehXW27aJxj/QPLfYR2LmTMbQKm3WpB8P1LjoiU7zjPoVoZ43a4P2JLUDidGKCd3eY5b5xewz
key #2:
2048 MD5:f7:98:f1:0b:73:c6:2a:21:00:7a:70:1d:0f:cf:d8:cc no comment (RSA)
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCQsZrjwKjB4WnE4SwVdDX5eEMxKzPHFBVKKpo9vvWUXRQwdTZy6iVOkyF26IPR+xDPzslzXOClKXUrWEh6La/EMpRwuMrWAbMIJFeDHOb56q4azgopoJmMJHo0yxGu0Ts4XszMACYRhlG6uK2AP5SYiOTp1zKPFjazXAdwLXyOvJurzy6KKuGJdSs/sj9+4uehgyRNOhehCSfg71tJJYwRvO2DDfLgaVEKOgZx58gEnJfhhz9D7rbvdZNhw/hCgtVNJaQF9Mdke2OPwWSo8i0/XNb9Bu/GRXqwMZrxDBhyzieocW40cwuzxWfzoi03aISdtQ1HtawH8+/sswviM1+B
For checking the fingerprint that is present on Azure Devops, you can use
$ ssh-keygen -E md5 -lf .ssh/id_rsa.pub
2048 MD5:ba:42:24:87:d6:7b:71:a2:3e:b5:9a:31:b2:2c:e0:00 CrazyGirrafe@Australasia (RSA)
ssh-keygen -r host.name.com
Will output the fingerprints for all configured public keys on an sshd instance.
These can then be put into DNS SSHFP records.
With OpenSSH 7.8 or greater, when using RSA keys, this will result in a matching fingerprint to the one that AWS is showing in their key list.
ssh-keygen -ef $path_to_private_key -m PEM | openssl rsa -RSAPublicKey_in -outform DER | openssl md5 -c
Here is another way to get fingerprint using common utilities on debian/ubuntu. This can be used to understand what ssh-keygen does behind the scene.
cat ~/.ssh/id_rsa.pub | awk '{print $2}' | base64 -d | md5sum
Sample Output:
abcdabcd123123123123123123123123 -
Explanation:
To add to the answer by @andrew.n -- Now that ssh-keygen gives the fingerprint in SHA-256 form, here is a way to replicate it:
echo 'AAAA...T3lOr70nKHGqE+DUKw==' | base64 -d | openssl dgst -sha256 -binary | base64
Unlike the old MD5 output, which was hex, now the output is the BASE64 version of the sha256 hash of the binary value of the key.
