faq_hostkey » Revisions »
Differences
This shows you the differences between the selected revisions of the page.
| faq_hostkey 2016-02-27 | faq_hostkey 2024-09-10 (current) | ||
| Line 3: | Line 3: | ||
| You should get an SSH host key fingerprint along with your credentials from a server administrator. Knowing the host key fingerprint and thus [[ssh_verifying_the_host_key|being able to verify it]] is an integral part of securing an SSH connection. It prevents [[wp>Man-in-the-middle_attack|man-in-the-middle attacks]]. | You should get an SSH host key fingerprint along with your credentials from a server administrator. Knowing the host key fingerprint and thus [[ssh_verifying_the_host_key|being able to verify it]] is an integral part of securing an SSH connection. It prevents [[wp>Man-in-the-middle_attack|man-in-the-middle attacks]]. | ||
| - | ===== Safely obtaining host key ===== | + | ===== [[obtaining]] Safely obtaining host key ===== |
| In the real world, most administrators do not provide the host key fingerprint. | In the real world, most administrators do not provide the host key fingerprint. | ||
| - | Instead you can ask anyone else with a physical access to the server. The host key is only one and hence the same for all users. Also note that the host key fingerprint is generated from a public key part of the host key only. So it is not secret and can be safely sent over an unencrypted (yet trusted) communication channels. | + | Instead you can ask anyone else who has a physical access to the server or who already knows the host key. The host key is only one and hence the same for all users. Also note that the host key fingerprint is generated from a public key part of the host key only. So it is not secret and can be safely sent over unencrypted (yet trusted) communication channels. |
| If you do not have anyone else to obtain the fingerprint from, you may need to connect to the server without knowing the fingerprint. Before connecting for the first time, ensure a security of your local machine and a line to the server. For example if you plan to connect to the server from an external site (e.g. from home or a client), but you have a physical access to the server site, connect from the server site the first time (e.g. your workplace). | If you do not have anyone else to obtain the fingerprint from, you may need to connect to the server without knowing the fingerprint. Before connecting for the first time, ensure a security of your local machine and a line to the server. For example if you plan to connect to the server from an external site (e.g. from home or a client), but you have a physical access to the server site, connect from the server site the first time (e.g. your workplace). | ||
| Line 15: | Line 15: | ||
| If you need to know the fingerprint later on for other purposes, like to verify the host key on another machine, or for automation, go to a //[[ui_fsinfo|Server and Protocol Information Dialog]]//. See a //Server Host key Fingerprint// box. | If you need to know the fingerprint later on for other purposes, like to verify the host key on another machine, or for automation, go to a //[[ui_fsinfo|Server and Protocol Information Dialog]]//. See a //Server Host key Fingerprint// box. | ||
| - | ===== Obtaining host key from PuTTY ===== | + | ===== [[from_putty]] Obtaining host key from PuTTY ===== |
| If you already have the host key cached in the PuTTY SSH client, you can import a PuTTY stored session to WinSCP, including the cached host keys. Make sure the //Import cached host keys for checked sites// option is checked when [[ui_import|importing the sessions]]. | If you already have the host key cached in the PuTTY SSH client, you can import a PuTTY stored session to WinSCP, including the cached host keys. Make sure the //Import cached host keys for checked sites// option is checked when [[ui_import|importing the sessions]]. | ||
| - | You can also have the fingerprint displayed in an %%SSH%% terminal using ''[[http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/ssh-keygen.1|ssh-keygen]]'' command (on *nix servers using OpenSSH server): | + | You can also have the fingerprint displayed in an %%SSH%% terminal using ''[[https://man.openbsd.org/ssh-keygen|ssh-keygen]]'' command (on *nix servers that use OpenSSH server). For example: |
| - | <code> | + | <code bash> |
| - | ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key | + | ssh-keygen -l -f /etc/<nohilite>ssh</nohilite>/ssh_host_rsa_key |
| - | ssh-keygen -l -f /etc/ssh/ssh_host_dsa_key | + | |
| </code> | </code> | ||
| + | |||
| + | To display all available host keys, you can use: | ||
| + | |||
| + | <code bash>for f in /etc/<nohilite>ssh</nohilite>/ssh_host_*_key; do ssh-keygen -l -f "$f"; done</code> | ||
| + | |||
| + | OpenSSH 6.8 and newer shows SHA-256 fingerprint by default. Older versions use MD5 fingerprint. | ||
| ===== Host key of your virtual server ===== | ===== Host key of your virtual server ===== | ||
| Line 30: | Line 35: | ||
| A special case is getting host key of a server, that you are an administrator of yourself, yet you do not have a direct secure line to connect through. This is common for virtual servers or servers in a cloud. In such case a server provider should have a specific solution. For example a specialized server in the same private network as your server, with publicly known host keys. You can connect to this specialized server and from it, securely connect to your server (e.g. using %%SSH%% terminal). As you are connecting within private network, you can safely trust any host key. Once connected to your server, acquire its host key. With that you can finally connect directly yet securely over a public network. Alternatively, the server provider can provide the host key via some administrative interface. For example see a solution for [[guide_amazon_ec2|Amazon EC2]], [[guide_google_compute_engine|Google Compute Engine]] or [[guide_microsoft_azure#linux|Microsoft Azure]]. | A special case is getting host key of a server, that you are an administrator of yourself, yet you do not have a direct secure line to connect through. This is common for virtual servers or servers in a cloud. In such case a server provider should have a specific solution. For example a specialized server in the same private network as your server, with publicly known host keys. You can connect to this specialized server and from it, securely connect to your server (e.g. using %%SSH%% terminal). As you are connecting within private network, you can safely trust any host key. Once connected to your server, acquire its host key. With that you can finally connect directly yet securely over a public network. Alternatively, the server provider can provide the host key via some administrative interface. For example see a solution for [[guide_amazon_ec2|Amazon EC2]], [[guide_google_compute_engine|Google Compute Engine]] or [[guide_microsoft_azure#linux|Microsoft Azure]]. | ||
| - | ===== Automatic host key verification ===== | + | ===== [[automation]] Automatic host key verification ===== |
| When writing a [[scripting|WinSCP script]] or [[library|code using WinSCP .NET assembly]], use the same methods as described previously to obtain the host key. | When writing a [[scripting|WinSCP script]] or [[library|code using WinSCP .NET assembly]], use the same methods as described previously to obtain the host key. | ||
| - | In scripting specify the expected fingerprint using ''[[scriptcommand_open#hostkey|-hostkey]]'' switch of an ''[[scriptcommand_open|open]]'' command. With .NET assembly, use ''[[library_sessionoptions#sshhostkeyfingerprint|SessionOptions.SshHostKeyFingerprint]]'' property. | + | In scripting specify the expected fingerprint using ''[[scriptcommand_open#hostkey|-hostkey]]'' switch of an ''[[scriptcommand_open|open]]'' command. With .NET assembly, use ''[[library_sessionoptions#sshhostkeyfingerprint|SessionOptions.SshHostKeyFingerprint]]'' property. Use SHA-256 fingerprint of the host key. |
| + | |||
| + | If you already have verified the host key for your GUI session, go to a //[[ui_fsinfo|Server and Protocol Information Dialog]]// and see a //Server Host key Fingerprint// box. You can have [[ui_generateurl|WinSCP generate the script or code]] for you, including the ''-hostkey'' switch or ''SessionOptions.SshHostKeyFingerprint'' property. | ||
| - | If you already have verified the host key for your GUI session, go to a //[[ui_fsinfo|Server and Protocol Information Dialog]]// and see a //Server Host key Fingerprint// box. //In the latest beta version//, you can have [[ui_generateurl|WinSCP generate the script or code]] for you, including the ''-hostkey'' switch or ''SessionOptions.SshHostKeyFingerprint'' property. &beta | + | In exceptional situations, when security is not required, such as when connecting within a trusted private network, you can use ''-hostkey=*'' or ''[[library_sessionoptions#giveupsecurityandacceptanysshhostkey|SessionOptions.GiveUpSecurityAndAcceptAnySshHostKey]]'' to blindly accept any host key. |
| - | In exceptional situations, when security is not required, such as when connecting within a trusted private network, you can use ''-hostkey=*'' or ''[[http://winscp.net/eng/docs/library_sessionoptions#giveupsecurityandacceptanysshhostkey|SessionOptions.GiveUpSecurityAndAcceptAnySshHostKey]]'' to blindly accept any host key. | + | If you want to allow a user to manually verify the host key, use the ''[[library_session_scanfingerprint|Session.ScanFingerprint]]'' method to retrieve the key fingerprint. Then let the user to verify it and assign the verified value to the ''SessionOptions.SshHostKeyFingerprint'' property. For an example of an implementation see [[library_example_known_hosts|*]]. |