You are browsing a read-only backup copy of Wikitech. The live site can be found at wikitech.wikimedia.org

Difference between revisions of "Help:SSH Fingerprints"

From Wikitech-static
Jump to navigation Jump to search
imported>Dzahn
(add comment about new fingerprint format)
imported>Dzahn
m (info about gen_fingerprints that is meanwhile installed everywhere)
Line 2: Line 2:


To find this information, locally you can just run this:
To find this information, locally you can just run this:
<pre>
gen_fingerprints
</pre> on any host (from ./modules/base/files/environment/gen_fingerprints), or...:
<syntaxhighlight lang="bash">for file in /etc/ssh/*_key.pub; do ssh-keygen -lf $file; done</syntaxhighlight>
<syntaxhighlight lang="bash">for file in /etc/ssh/*_key.pub; do ssh-keygen -lf $file; done</syntaxhighlight>



Revision as of 00:39, 27 October 2016

To find this information, locally you can just run this:

gen_fingerprints

on any host (from ./modules/base/files/environment/gen_fingerprints), or...:

for file in /etc/ssh/*_key.pub; do ssh-keygen -lf $file; done

If your client shows the new base64 encoded format by default, use ssh -o FingerprintHash=md5 to compare to the format used here.

Remotely (and to format it for these pages), something like this should work:

#!/usr/bin/python3
import sys
if len(sys.argv) == 0:
	print('Must specify hostname')
	sys.exit(0)
hostname = sys.argv[1]
port = 22
if len(sys.argv) > 2:
	port = sys.argv[2]

import collections, subprocess, tempfile
with tempfile.NamedTemporaryFile() as tf:
	keyscanCommand = 'ssh-keyscan', '-t', 'rsa,ecdsa,ed25519', '-p', str(port), hostname
	subprocess.call(keyscanCommand, stdout = tf.file, stderr = open('/dev/null'))

	fingerprints = collections.defaultdict(list)
	for fingerprintHash in ['md5', 'sha256']:
		keygenCommand = ['ssh-keygen', '-l', '-E', fingerprintHash, '-f', tf.name]
		keygenProcess = subprocess.Popen(keygenCommand, stdout = subprocess.PIPE)
		stdout, stderr = keygenProcess.communicate()
		for line in stdout.decode('ascii').splitlines():
			bitlen, fingerprint, hostname, type = line.split(' ')
			fingerprints[type[1:-1]].append(fingerprint)

	for type, keys in fingerprints.items():
		print(';' + type + ':')
		for key in keys:
			print('* <code>' + key + '</code>')
		print()

Assuming you have OpenSSH 6.8+ (Ubuntu 15.10 provides 6.9). If you don't, you'll need to get rid of the 'sha256' list entry and remove the "'-E', fingerprintHash, ".