如何通过向 SSH 客户端提供指纹来确保 SSH 服务器的真实性?

如何通过向 SSH 客户端提供指纹来确保 SSH 服务器的真实性?

问题:

第一次连接到 SSH 服务器时,OpenSSH 客户端会要求用户通过检查指纹来确认服务器的真实性:

$ ssh -o UserKnownHostsFile="/tmp/authtest" -o CheckHostIP=no -l user -p 22 169.254.0.2
The authenticity of host '169.254.0.2 (169.254.0.2)' can't be established.
ECDSA key fingerprint is SHA256:jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

旁边yes还有no最近添加第三个选项(即[fingerprint])。不幸的是,第三个选项尚未被记录,然而。第三个选项背后的想法是向客户端提供指纹(已在带外接收)以继续。

我无法使第三个选项发挥作用:

$ ssh-keyscan 169.254.0.2
# 169.254.0.2:22 SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u1
169.254.0.2 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGgeT2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+nA=
# 169.254.0.2:22 SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u1
169.254.0.2 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9x/X2yDAdEROoeqQGXk+MJFuk0qUtDNiI7Oxigk66RfTZEjhHnKix4X+ZF/l5FOzcdxivwvSckiMEqW78vZ3YfZx4kSbnMnIQnny5mgnIo3U10oBe86KGq8OZX7yilovQp5j0m+M4WtIt3qtAk02KYsLEkxnLAVoO0H+5rTmIxpjsX/SLgkJ2FjE1WvUiPEL8l1+z50/RDrVkfiwsvzSmmjrV5A70BhonFHmDO1wCNlivuAIR4GW0tKgefn4LLwK9MJjIQj6fPxAR0W28SV79kd17RIoTezbXrxku5OTx5zvnRLKltkJoW2d/7jSvnD/OyjfZJLqACVRQvhQmYp3L
# 169.254.0.2:22 SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u1
169.254.0.2 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAgkzMtRx0jXgzyU7mBbS8fZoCk2Ky+PoZsDnmhQUOwI

$ ssh -o UserKnownHostsFile="/tmp/testkeys" -o CheckHostIP=no -l user -p 22 169.254.0.2
The authenticity of host '169.254.0.2 (169.254.0.2)' can't be established.
ECDSA key fingerprint is SHA256:jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA.
Are you sure you want to continue connecting (yes/no/[fingerprint])? SHA256:jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA.
Please type 'yes', 'no' or the fingerprint: [SHA256:jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA.]
Please type 'yes', 'no' or the fingerprint: jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA.           
Please type 'yes', 'no' or the fingerprint: [jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA.]
Please type 'yes', 'no' or the fingerprint: AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGgeT2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+nA= 
Please type 'yes', 'no' or the fingerprint: [AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGgeT2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+nA=]
Please type 'yes', 'no' or the fingerprint: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGgeT2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+nA= 
Please type 'yes', 'no' or the fingerprint: [ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGgeT2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+nA=]

问题:

我应该如何/以何种格式向 SSH 客户端提供指纹?

附加信息:

SSH 客户端版本:

$ ssh -V
OpenSSH_8.1p1 Debian-1, OpenSSL 1.1.1d  10 Sep 2019

服务器的公钥:

ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGgeT2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+nA= root@debian

服务器的私钥(不要惊慌 - 密钥仅针对此问题生成):

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQRp72PfnMKPAUhoHk9juUYx+VDGQWwA
KSBvj8uE/f29Jn9BFIjD/bun1Yvcd3my64Z9RNq8ratQA+kz0Xbs8PpwAAAAqN7iWqPe4l
qjAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGnvY9+cwo8BSGge
T2O5RjH5UMZBbAApIG+Py4T9/b0mf0EUiMP9u6fVi9x3ebLrhn1E2rytq1AD6TPRduzw+n
AAAAAgOFpyGXQLAz/A9uBxx4KkbDSZ/ZDUTwt3bsVYUr2hxhgAAAALcm9vdEBkZWJpYW4B
AgMEBQ==
-----END OPENSSH PRIVATE KEY-----

答案1

这个点不是指纹的一部分。

因此答案应该是:

SHA256:jCl+n/PrVUuU5WxXFX+hg05a98Ih2LHcPcwqnHi6CuA

相关内容