RSA Fingerprints on EC2 Server Don't Match Locally Generated Fingerprint

Question

I have an EC2 instance with an elastic IP that hasn't changed in a little while, nor has the ssh key Amazon installed in the main user account used to ssh into the server after instantiation.

I recently decided I should actually learn how to check my RSA fingerprints. So, I cleared out the known_hosts file on my local machine.

Amazon gives you a *.pem file to use as your private key on new EC2 instances. So, I used the following command to generate the public half of the key locally:

ssh-keygen -yf my-key.pem > my-key.pub

Then, I got the fingerprint of that key using the following command:

ssh-keygen -lf my-key.pub

Then, I started up an ssh connection to my EC2 instance and--the fingerprints didn't match!

How f'ed am I? Did I do anything wrong that would explain the fact that my fingerprints didn't match?

Answer 1

The fingerprint of your public key is not the fingerprint of the SSH server's key, those are different. Refer to section 1 of the following page: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.html

(Optional) You can verify the RSA key fingerprint on your instance by using one of the following commands on your local system (not on the instance). This is useful if you've launched your instance from a public AMI from a third party. Locate the SSH HOST KEY FINGERPRINTS section, and note the RSA fingerprint (for example, 1f:51:ae:28:bf:89:e9:d8:1f:25:5d:37:2d:7d:b8:ca:9f:f5:f1:6f) and compare it to the fingerprint of the instance.

• get-console-output (AWS CLI)

aws ec2 get-console-output --instance-id instance_id

• ec2-get-console-output (Amazon EC2 CLI)

ec2-get-console-output instance_id

Note The SSH HOST KEY FINGERPRINTS section is only available after the first boot of the instance.