When I use an Ubuntu from linode

ssh-keygen -l defaults to looking for an RSA file to "list".

Yet ssh issued from a client asks for verification of the remote linode's ECDSA key.

This means that on the linode the following

ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub would have to be issued in order to know the key which is inconvenient and hard to remember.

Should it not be that both tools default to RSA or that both tools default to ECDSA. Why are the defaults "out of synch"?

Edit: To clarify, ssh-keygen -l seems to default to RSA and it knows the default path. If ssh would prompt with an RSA key then ssh-keygen can be used with the shorter command. Unfortunately, ssh prompts with the ECDSA key.

closed as off-topic by multithr3at3d, Xander, forest, NULLZ, Serge Ballesta Jul 2 at 13:26

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – multithr3at3d, Xander, forest, NULLZ, Serge Ballesta
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm not sure what your problem really is. Maybe you assume that the key type used to authenticate the server to the client (i.e. key of the server) must match the one used to authenticate the client to the server (i.e. key of the client). This is not the case, i.e. server and client keys are fully independent from each other which also includes what key types are used. – Steffen Ullrich Jun 22 at 2:36
  • @SteffenUllrich, I posted an edit. – H2ONaCl Jun 22 at 3:31
  • Still not clear what your problem is. ssh-keygen -l defaults to keys in the home directory. Thus, for showing the host keys located under /etc/ssh instead you would need to add a filename anyway, no matter if RSA or ECDSA. – Steffen Ullrich Jun 22 at 3:36
  • @SteffenUllrich, I want both tools to default to RSA or both to default to ECDSA and I am trying to understand why this is not the case. – H2ONaCl Jun 22 at 4:16

ssh-keygen -l seems to default to RSA and it knows the default path.

ssh-keygen -l defaults to use a RSA key within the users home directory, i.e. ~/.ssh/id_rsa. Keys in the home directory are used to authenticate the client to the server. What you want to verify instead is the host key which is used to authenticate the server against the client. To get this fingerprint you need to specify the key with the -f argument no matter if RSA or ECDSA is used since it is not located in the users home directory but in a system directory, typically /etc/ssh.

If ssh would prompt with an RSA key then ssh-keygen can be used with the shorter command. Unfortunately, ssh prompts with the ECDSA key.

SSH prompts with whatever key the server is presenting to the client, i.e. it fully depends on the server setup and not on some SSH builtin defaults.

  • "It fully depends on the server setup" okay, I had no opinion about the cause, I only care about the effect. So perhaps openssh-server (or whatever is used by Ubuntu on Linode) by default sends ECDSA to ssh but the implementation of ssh-keygen -l defaults to RSA because nobody cares? – H2ONaCl Jun 22 at 6:19
  • Or is it that the implementation of ssh-keygen -l should not be changed because ~/.ssh/id_rsa.pub is a good default? I never want to look at my ~/.ssh/id_rsa.pub so for me it is not a good default but perhaps other people have a need. – H2ONaCl Jun 22 at 6:23
  • @H2ONaCl: "...I had no opinion about the cause, I only care about the effect. " - you are claiming that "both tools" have different settings. The only tools you mention are ssh-keygen and ssh. – Steffen Ullrich Jun 22 at 6:23
  • Yes, one is defaulting to ECDSA (openssh-server to ssh) and the other to RSA (ssh-keygen -l) – H2ONaCl Jun 22 at 6:26
  • "I never want to look at my ~/.ssh/id_rsa.pub so for me it is not a good default but perhaps other people have a need" - this is a completely different question. Your original question was only about ECDSA vs. RSA as default. This here is about showing user key (i.e. client key) or host key (server key) as default and then RSA vs. ECDSA on top of it. – Steffen Ullrich Jun 22 at 6:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.