0

Supposed I have a number of HTTPS servers on different networks, would it be safe enough to use them together to verify a new SSH daemon's public key? i.e. if they all return the same fingerprint, is it safe enough to assume there is no MITM attack?

I'm aware of SSH certs, but it gets tough to implement with most shared hosting.

Thanks.

3
  • How do these HTTPS servers get the SSH server key? If they just retrieve the key from the server they might be affected the same MITM you fear. But if you fear a MITM more local to the client (like in the same network) then it might be sufficient since in this case the (non-local) HTTPS servers will likely not be affected by the MITM, Apr 30 at 15:52
  • Among the HTTPS servers, I was thinking one of them should be the SSH daemon itself. I wanted to read the public key file directly, but that wasn't possible on shared hosting. So next best option was to connect to 127.0.0.1 using SSH. The other HTTPS servers can only connect via SSH to read the fingerprint.
    – user256473
    May 1 at 7:22
  • This is similar to the idea behind Perspectives or Convergence. See en.wikipedia.org/wiki/Convergence_(SSL)
    – mti2935
    Oct 18 at 13:44
0

Reusing the same ssh host key on multiple servers is a security risk. If one server is compromised, the attacker can intercept all connections to your servers.


If the servers are administrated by another person, you should ask this person over a trused channel.

Trusted channels are:


If you own the server you can use a local terminal. On a virtual machine, you can use the management interface to open such a terminal. Physical machines (bare matel) server should have some remote management devices like KVM Switches or built in the bios/uefi.

By default OpenSSH stores the keys in /etc/ssh.

Follwing command calculates the SHA256 hash:

for file in /etc/ssh/*.pub; do   ssh-keygen -lf $file; done

Older implementations of openssh generates MD5 fingerprints

for file in /etc/ssh/*.pub; do   ssh-keygen -lf $file -E md5; done

You have multiple keys with different algorithms. Depending on your server and your client, one of those keys are used.

Now you can compare the shown fingerprint from the client with the the calculated fingerprints.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.