SSH authenticity can't be established... ECDSA Key fingerprint

andrewysk · 08-01-2021, 01:31 AM

Quote:

Originally Posted by computersavvy

If you are configured to use keys and not passwords, then the host you are sshing from must have the public key for the host you are sshing to (even if it is the same host). The host you are connecting to must have the private key that matches the public key used.

Yes it is quite possible to ssh in an almost infinite link from one host to another and on and on and on......
I have even, repeatedly, sshed to one host then back to the original host instead of logging out and back in later.

I need to get the term for ssh client machine term and ssh server machine clear ?
From your post above, "the host" is refering to ssh client or ssh server ? I don't get your answer clear.
Were you saying, you can sshing into an ssh server1, then sshing from the ssh server1 into ssh server2..... and keep sshing from ssh server(n-1) into ssh server(n)... into infinity ?
BUT, i was saying "i was sshing from ssh client computer1 into ssh server computer1" and on the same time "sshing from server computer1 back into ssh client computer1" , but "ssh server computer1" prompted:

Code:

currentUserName@hostIP: Permission denied (publickey).

. is it suppose to be so ?

I think you meant the ssh client machine mush have "public key " ? ?
Isn't public key is only for ssh server ?
The location for "private key" is suppose to be in "$HOME/.ssh/"

Quote:

the host you are sshing from must have the public key

I am now confused. You meant the ssh server must have private key ?
Isn't ssh server must have public key only ?
The location for "public key" is suppose to be in "$HOME/.ssh/".

Quote:

The host you are connecting to must have the private key that matches the public key used.

Turbocapitalist · 08-01-2021, 01:50 AM

Quote:

Originally Posted by andrewysk

I need to get the term for ssh client machine term and ssh server machine clear ?
From your post above, "the host" is refering to ssh client or ssh server ? I don't get your answer clear.

One important piece of background information is that there are two categoies of usage for the SSH key pairs involved here.

1) In your heading for this thread, and in the original post, you mention "The authenticity of host ... can't be established. ECDSA key fingerprint ..." That key pair is the one which the SSH server uses to identify itself to the SSH client. Those key pairs are kept on the system running the SSH server in the /etc/ssh/ directory. Those keys are one per SSH server¹. The idea is that the first time you connect you compare the fingerprint of the public key being offered with the fingerprint for the key known to be on the server. The SSH client will store that key and associate it with that one address or domain name. By default the storage location for those tuples is ~/.ssh/known_hosts, supplemented by /etc/ssh/ssh_known_hosts if pre-loaded by the system administrator.

2) When using key-based authentication, you are dealing with a different category than in your original post. Specifically, keys used for key-based authentications use a key-pair which identifies the SSH client session to the SSH server. You can have as many of those as you find usage for. The public key gets stored in the relevant account on the server in ~/.ssh/authorized_keys by default, though there are advanced alternatives. On the client, the full key pair usually gets stored in ~/.ssh/ or even a hardware token. You can name those key pairs whatever you want.

tldr; Before you identify your account to the server, the server proves its identity to your account. Each task uses separate pairs of keys.

--

¹ Although only one of any given type is actually used, technically the SSH server might offer several types, ECDSA, RSA, or Ed25519. According to your post, you are getting offered an ECDSA key.