How to Add an SSH Fingerprint to Your Known_hosts File

Establishing trust between your local machine and a remote server is crucial for secure SSH connections. Adding an SSH fingerprint to your known_hosts file ensures that your system recognizes the server and prevents man-in-the-middle attacks. This process is especially useful when connecting to a server for the first time or when the server’s fingerprint has changed. Before you begin, ensure you have access to the server’s SSH fingerprint or can retrieve it securely. This guide walks you through the straightforward steps to manually add an SSH fingerprint to your known_hosts file on a Linux system, enhancing your connection security and avoiding SSH warnings during login.

What You’ll Need

• Access to your Linux terminal or command line interface
• Knowledge of the server’s SSH fingerprint or the ability to retrieve it
• Basic familiarity with SSH commands
• Permissions to modify files in your ~/.ssh directory (usually your user account)

Step-by-Step

1. Open your terminal: Launch your Linux terminal or command line interface where you manage SSH connections.
2. Locate or create the known_hosts file: The known_hosts file is typically located at ~/.ssh/known_hosts. To ensure it exists, run:

   ls ~/.ssh/known_hosts

   If it doesn’t exist, create it with:

   touch ~/.ssh/known_hosts

3. Obtain the server’s SSH fingerprint: You can get the server’s fingerprint using the ssh-keyscan command or from your server administrator. To retrieve it via ssh-keyscan, run:

   ssh-keyscan -t rsa your.server.com

   Replace your.server.com with the server’s hostname or IP address.

4. Extract the fingerprint: The output from ssh-keyscan provides the server’s public key. To check its fingerprint, run:

   ssh-keygen -lf <(ssh-keyscan -t rsa your.server.com)

   This command displays the fingerprint, which you should verify with the server administrator for authenticity.

5. Manually add the fingerprint to known_hosts: Once you have verified the fingerprint, you can add the server's key directly to known_hosts. Append the entire line from ssh-keyscan output to your known_hosts file:

   ssh-keyscan -t rsa your.server.com >> ~/.ssh/known_hosts

   Alternatively, you can copy the specific key line and add it manually to avoid duplicates.

6. Verify the addition: To confirm the key was added correctly, run:

   tail -n 10 ~/.ssh/known_hosts

   and ensure the server's fingerprint appears in the file.

7. Test your SSH connection: Now, try connecting to the server with:

   ssh your.server.com

   You should connect without warnings if the fingerprint matches.

Common Mistakes

• Adding unverified or incorrect fingerprints, which can compromise security.
• Appending duplicate entries in known_hosts, leading to clutter or confusion.
• Using the wrong key type (e.g., RSA vs. ED25519) when retrieving or adding the fingerprint.
• Modifying known_hosts manually without proper formatting, causing SSH to reject the file.
• Not verifying the fingerprint with the server administrator before adding, risking man-in-the-middle attacks.

Tips

• Always verify the server’s fingerprint with the administrator or through a secure channel before adding it.
• Use ssh-keyscan with the correct key type to match the server’s configuration.
• If you encounter duplicate entries, clean up your known_hosts file by removing old or incorrect keys.
• Back up your known_hosts file before making manual edits, to prevent accidental loss.
• Consider automating fingerprint verification in scripts for large-scale deployments.

Troubleshooting

If your SSH connection still warns about the server's authenticity or fails to connect after adding the fingerprint:

• Check the format of known_hosts: Ensure the entry is correctly formatted, with the hostname/IP, key type, and key data separated by spaces.
• Verify the fingerprint: Use ssh-keygen -lf to confirm the fingerprint matches what you expect.
• Remove conflicting entries: If multiple entries exist for the same hostname, remove outdated or incorrect ones from known_hosts.
• Ensure permissions are correct: The ~/.ssh directory and known_hosts file should have appropriate permissions (600 for files, 700 for directories).
• Re-run ssh-keyscan: Fetch the key again to ensure the latest key is added and no errors occur.
• Consult server logs or administrator: If issues persist, check server logs or ask the administrator to confirm the server’s key fingerprint.

Frequently Asked Questions

1. Can I add multiple server fingerprints at once?

Yes, by running ssh-keyscan for each server and appending the output to known_hosts. Be sure to verify each fingerprint before adding.

2. What if I get a warning about a changed fingerprint?

This indicates the server’s key has changed. Verify with the server administrator before updating your known_hosts to prevent security risks.

3. Is manually editing known_hosts safe?

It is safe if you correctly format the entries and verify the fingerprints. Always back up before editing to avoid corrupting the file.

4. How do I remove an old or incorrect fingerprint?

Use a text editor to delete the specific line from ~/.ssh/known_hosts. Alternatively, use the ssh-keygen -R command to remove entries for a hostname or IP.

5. Should I use the ssh-keyscan command every time I connect?

No, only when connecting to a new server or when the server’s key has legitimately changed. Otherwise, SSH automatically verifies the key.

6. What is the best way to ensure I trust the server’s fingerprint?

Always verify the fingerprint through a secure channel with the server administrator before adding it to your known_hosts.

By following these steps, verifying the server’s fingerprint, and understanding common pitfalls, you can securely manage SSH host keys and avoid security warnings during your SSH sessions. Properly maintaining your known_hosts file ensures a safer and smoother connection experience every time you connect to remote servers.

Related

• How to Add a Toolbar in Windows 11 for Better Productivity
• How to Add a TikTok Shop Link to Your Live Video or Bio
• How to Add a Timer in Google Slides for Presentations