Hello,

I've learned linux just for 3 weeks, and now encountered a confusion with ssh.

I have a server running Fedora 4, mine machine is running Fedora 5. When I look at /etc/ssh/ I saw the following:

ssh_host_dsa_key
ssh_host_dsa_key.pub
ssh_host_key
ssh_host_key.pub
ssh_host_rsa_key
ssh_host_rsa_key.pub

I knew that ssh_host_key and its .pub is for sshv1, so no need to care. But about the rest, could anyone show me the difference between dsa and rsa keys, and how important they are, or when do we you dsa keys, and when is rsa.

Another issue, when I first ssh to my server, it asked:

The authenticity of host 'my server' can't be established.
RSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Are you sure you want to continue connecting (yes/no)?

Why do we need RSA key figerprint, and where it's stored in the machine?

Next issue, after successfully login to my server. In theory, the public key of my machine is sent to the server and vice versa (not sure which key it is, rsa or dsa). So I checked for ~/.ssh/known_hosts in my machine, it showed the correct pub key of the server, but when I look at the same file in the server, it does not have the entry for my machine public key.

Therefore, I'm just wondering where it stored my public key to decrypt my packets during ssh commmunication, or does it store it in memory and discarded it after ssh communication is terminated?

I'm idiot enough, and hope to have a light out of my brain.

SG.

Hi Starghost,

Welcome to linuxquestions.org


rsa and dsa are encryption algorithms used to create signatures among other uses.

Server does not store the clients keys







Aniruddha

DSA (Digital Signiture Algorithm) and RSA (Rivest-Shamir-Adleman algorithm) keys are used for digital signing and authentication. RSA is older and faster than DSA, but weaker in terms of security. However, DSA can only be used for signitures, whereas RSA can be used for encryption as well. Think of them as competing brand names - some folk like on and others prefer t'other. A server needs to know about them both - most likely - unless you want to deliberately exclude one brand that is.

OpenSSH only uses these for the authentication stage.

It can help to search the forums:
http://www.linuxquestions.org/questi...ad.php?t=12593

Thanks for your response. As you said, OpenSSH only uses those keys (DSA or RSA) for Authentication, but I thought that the main idea of using public and private keys is for encryption. So what is used for encryption?

Thanks,

SG.

Server's public key is given to the client so it can encrypt data going to the Server.

The server and client use this asymmetrical key to encrypt the data to exchange a symmetric key that will be use to encrypt the data for the rest of the session.

(I think ?!?)

http://www-128.ibm.com/developerwork...ry/l-keyc.html
http://www.linuxforums.org/forum/lin...-security.html
http://www.openssh.org/faq.html
http://www.openssh.com/features.html


OpenSSH uses 3DES, Blowfish, AES and arcfour as encryption algorithms.

Regarding the question regarding "The authenticity of host 'my server' can't be established." and also what goes in known_hosts, it's important to understand there is no central authority concept in SSH as you get with PKI (e.g. accessing an SSL site, where a certificate has been signed by an authority such as Verisign).

The first time a SSH client connects to a SSH server, the server will present its public key to the client as part of the authentication process. Because the client has never seen that public key before it asks you to verify it by displaying the fingerprint of the key, which you could in theory pass to people out-of-band (e.g. via an e-mail, printout, etc.). Once you accept the fingerprint, the client then stores the public key in ~/.ssh/known_hosts.