主页 / computer / 问题 / 1510984
Accepted
dirdi
Asked: 2019-12-19 03:52:29 +0800 CST

如何通过向 SSH 客户端提供指纹来确保 SSH 服务器的真实性？

  • 772

问题：

第一次连接到 SSH 服务器时，OpenSSH 客户端会通过检查其指纹来要求用户确认服务器的真实性：

$ ssh -o UserKnownHostsFile="/tmp/authtest" -o CheckHostIP=no -l user -p 22 169.254.0.2
The authenticity of host '169.254.0.2 (169.254.0.2)' can't be established.
ECDSA key fingerprint is SHA256:jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

此外yes，no最近还添加了第三个选项（即[fingerprint]）。不幸的是，这第三个选项还没有被记录在案。第三个选项背后的想法是向客户端提供指纹（已在带外接收）以继续。

我无法使第三个选项起作用：

$ ssh-keyscan 169.254.0.2
# 169.254.0.2:22 SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u1
169.254.0.2 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGgeT2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+nA=
# 169.254.0.2:22 SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u1
169.254.0.2 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9x/X2yDAdEROoeqQGXk+MJFuk0qUtDNiI7Oxigk66RfTZEjhHnKix4X+ZF/l5FOzcdxivwvSckiMEqW78vZ3YfZx4kSbnMnIQnny5mgnIo3U10oBe86KGq8OZX7yilovQp5j0m+M4WtIt3qtAk02KYsLEkxnLAVoO0H+5rTmIxpjsX/SLgkJ2FjE1WvUiPEL8l1+z50/RDrVkfiwsvzSmmjrV5A70BhonFHmDO1wCNlivuAIR4GW0tKgefn4LLwK9MJjIQj6fPxAR0W28SV79kd17RIoTezbXrxku5OTx5zvnRLKltkJoW2d/7jSvnD/OyjfZJLqACVRQvhQmYp3L
# 169.254.0.2:22 SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u1
169.254.0.2 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAgkzMtRx0jXgzyU7mBbS8fZoCk2Ky+PoZsDnmhQUOwI

$ ssh -o UserKnownHostsFile="/tmp/testkeys" -o CheckHostIP=no -l user -p 22 169.254.0.2
The authenticity of host '169.254.0.2 (169.254.0.2)' can't be established.
ECDSA key fingerprint is SHA256:jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA.
Are you sure you want to continue connecting (yes/no/[fingerprint])? SHA256:jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA.
Please type 'yes', 'no' or the fingerprint: [SHA256:jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA.]
Please type 'yes', 'no' or the fingerprint: jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA.           
Please type 'yes', 'no' or the fingerprint: [jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA.]
Please type 'yes', 'no' or the fingerprint: AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGgeT2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+nA= 
Please type 'yes', 'no' or the fingerprint: [AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGgeT2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+nA=]
Please type 'yes', 'no' or the fingerprint: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGgeT2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+nA= 
Please type 'yes', 'no' or the fingerprint: [ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGgeT2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+nA=]

问题：

我应该如何/以什么格式向 SSH 客户端提供指纹？

附加信息：

SSH 客户端版本：

$ ssh -V
OpenSSH_8.1p1 Debian-1, OpenSSL 1.1.1d  10 Sep 2019

服务器的公钥：

ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGgeT2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+nA= root@debian

服务器的私钥（不要惊慌 - 仅针对此问题生成了密钥）：

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQRp72PfnMKPAUhoHk9juUYx+VDGQWwA
KSBvj8uE/f29Jn9BFIjD/bun1Yvcd3my64Z9RNq8ratQA+kz0Xbs8PpwAAAAqN7iWqPe4l
qjAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGge
T2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+n
AAAAAgOFpyGXQLAz/A9uBxx4KkbDSZ/ZDUTwt3bsVYUr2hxhgAAAALcm9vdEBkZWJpYW4B
AgMEBQ==
-----END OPENSSH PRIVATE KEY-----
ssh linux

1 个回答

  1. Best Answer

    该点不是指纹的一部分。

    所以答案应该是：

    SHA256:jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA
    • 4

相关问题