Skip to main content
added 595 characters in body
Source Link
aiao
  • 419
  • 5
  • 7

The server does not know any secrets that can be used to authenticate itself.

Also, what good is a fingerprint if it is based on the public key if it is basically the hash of some known public key.

What protection is there from an "ssh server spoofing"?

SUMMARY AND REFLECTIONS: I have already seen the duplicate question before posting this one up. The part that for me was not clear, is that the server too has a private key. And when you attempt to connect to sshd, it will send you the fingerprint of the sshd public key (this will probably be found in the /etc/sshd, different that the ones found in the /home/<users>/.ssh).

This is why ssh keys asks about authorizing a fingerprint on first connect. This is also why the fingerprint changes if you do a new sshd install (new public-private key pair has been generated).

The server does not know any secrets that can be used to authenticate itself.

Also, what good is a fingerprint if it is based on the public key if it is basically the hash of some known public key.

What protection is there from an "ssh server spoofing"?

The server does not know any secrets that can be used to authenticate itself.

Also, what good is a fingerprint if it is based on the public key if it is basically the hash of some known public key.

What protection is there from an "ssh server spoofing"?

SUMMARY AND REFLECTIONS: I have already seen the duplicate question before posting this one up. The part that for me was not clear, is that the server too has a private key. And when you attempt to connect to sshd, it will send you the fingerprint of the sshd public key (this will probably be found in the /etc/sshd, different that the ones found in the /home/<users>/.ssh).

This is why ssh keys asks about authorizing a fingerprint on first connect. This is also why the fingerprint changes if you do a new sshd install (new public-private key pair has been generated).

Post Closed as "Duplicate" by RoraΖ, Xander, SilverlightFox, user45139, schroeder
Post Migrated Here from crypto.stackexchange.com (revisions)
Source Link
aiao
  • 419
  • 5
  • 7

How is the server authenticated in ssh?

The server does not know any secrets that can be used to authenticate itself.

Also, what good is a fingerprint if it is based on the public key if it is basically the hash of some known public key.

What protection is there from an "ssh server spoofing"?