ssl_fingerprint []

This is an old revision of the document!

Public Fingerprint

Overview

Used for identification/verification of the host you are connecting to

Explanation

A public key is encoded into a sequence of bytes (hashed with SHA1/SHA2) - this can then be recreated when next connecting to the device to verify that the device is the same device you connected to before.

If the fingerprint has changed, it means the machine you are connecting to has had their public key changed.
This could be due to OS re-installs, re-installing ssh
However this could also mean that the machine you are connecting to is different. If you are sshing to a domain then the server behind the domain may have changed, or you could be targeted by a main-in-the-middle attack where the attacker somehow intercepts/reroutes your ssh connection to a different machine. They could be doing this to snoop your username and password combination.

A servers public key is stored:

/etc/ssh/ssh_host_rsa_key.pub

The authenticity of host 'x.x.x.x (x.x.x.x)' can't be established.
RSA key fingerprint is 59:c7:8c:34:e7:97:c1:3z:e4:3a:13:e2:g6:39:7c:k9.
Are you sure you want to continue connecting (yes/no)?

If you now run the following command on the server you have just connected to, you should get the same RSA fingerprint:

Flag	Explanation
-l	Show fingerprint of specified public key file. Private RSA1 keys are also supported. For RSA and DSA keys ssh-keygen tries to find the matching public key file and prints its fingerprint. If combined with '-v', an ASCII art representation of the key is supplied with the fingerprint

[root@LLL ssh]# for file in *sa_key.pub
do   ssh-keygen -lf $file
done

Ouput should be similar:

1024 df:7e:cd:54:4a:76:78:3e:2a:23:32:de:30:6n:09:43 ssh_host_dsa_key.pub (DSA)
2048 59:c7:8c:34:e7:97:c1:3z:e4:3a:13:e2:g6:39:7c:k9 ssh_host_rsa_key.pub (RSA)

Security Threats

- Man-in-the-middle Attack
- Preimage Attack
- Collision Attack

http://www.phcomp.co.uk/Tutorials/Unix-And-Linux/ssh-check-server-fingerprint.html
https://en.wikipedia.org/wiki/Public_key_fingerprint
http://www.lysium.de/blog/index.php?/archives/186-How-to-get-ssh-server-fingerprint-information.html