Host keys

A host key proves you reached the server you meant to, not something in between. Gatesys SSH stores each server’s SHA256 fingerprint the first time you trust it, and warns you loudly if that key ever changes.

The first connection #

The first time you reach a server, or a hop in a jump chain, you see Unknown host key with the key type and its SHA256 fingerprint.

1. Get the fingerprint from somewhere you trust: the server’s operator, your provisioning system, or the server itself.
2. Compare it with the one on screen.
3. Click Trust and connect if they match, or Cancel if they do not.

To read the fingerprint on the server:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Use the file that matches the key type shown, for example ssh_host_rsa_key.pub or ssh_host_ecdsa_key.pub.

Trusted keys are stored per address and port, so 10.0.3.4:22 and 10.0.3.4:2223 are separate entries. Gatesys SSH keeps its own list and does not read ~/.ssh/known_hosts.

When a known key changes #

If a server presents a different key from the one you trusted, you see Host key has changed with a warning, the fingerprint it had before and the one it has now.

A changed key has two common causes:

• Expected: the server was rebuilt or reinstalled, or its keys were rotated.
• Not expected: something is intercepting the connection.

Only continue if you know why it changed.

When you cancel, Hop Doctor’s report shows both fingerprints and an explanation. It never offers a button to trust the key. That decision stays in this dialog, where you see the warning.

Keys the app never accepts on its own #

Some connections are made by Gatesys SSH rather than by you, and none of them accept an unknown or changed key:

• Background checks refuse a new or changed key outright rather than asking.
• Safe Change’s fresh login after a config change never prompts for a host key. After a port move, it accepts only the key already trusted on the old port, and saves it for the new port only once you confirm Keep. See Safe Change.
• A pasted ssh -o StrictHostKeyChecking=no … has that option ignored. Host keys are always checked.

Checking a fingerprint with someone else #

The login timer stops while the host key dialog is open. You can take the time to check a fingerprint with an administrator, and the connect will not time out or count as a refused key.