DHIVA LABS · LEARN

Appearance

Verify host keys ​

Make sure you are talking to the real server, not an impostor, by checking its host key the first time you connect and taking the warning seriously if it ever changes.

Why host keys matter ​

Every SSH server has a host key, a key pair that identifies the machine. When you connect, the server proves it holds that key. SecureShell Go remembers the key for each server (by host, port and key type, the same way OpenSSH's known_hosts file does) and checks it every time.

This protects you from a machine-in-the-middle attack: someone on the network, such as a fake Wi-Fi hotspot, pretends to be your server, collects your password, and passes your traffic on so you notice nothing. The impostor cannot fake the real server's host key, so the key check catches it.

The check only works if the key you trusted the first time was the real one. That is why the first connection asks you to compare a fingerprint.

The first connection: Unknown host ​

The first time you connect to a server, the Unknown host dialog shows:

  • Host: the address and port.
  • Key type: for example ssh-ed25519.
  • SHA256 fingerprint: a short code, such as SHA256: followed by 43 characters, computed from the server's host key.

  1. Get the fingerprint from a source you trust, not from the same network connection. For example, ask the server's owner, look in your hosting provider's web console, or run this on the server's own screen or console:

    bash
    ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

    Use the file that matches the Key type shown: ssh_host_rsa_key.pub for ssh-rsa, ssh_host_ecdsa_key.pub for ECDSA.

  2. Compare it with the fingerprint in the dialog, character by character.

  3. If they match, tap Accept & save. The key is stored and you will not be asked again for this server.

  4. If they do not match, tap Reject and find out why before connecting.

If you truly cannot check the fingerprint, for example on a brand-new home server on your own network, accepting it is a judgement call: you are trusting that nobody is interfering at that moment. Do not accept an unchecked fingerprint on public or shared Wi-Fi.

When the host key changes ​

If a server you trusted presents a different key, SecureShell Go blocks the connection and shows Host key has CHANGED, with the Previously trusted fingerprint and the one Offered now.

The app's own warning says it plainly: someone may be eavesdropping on you right now, or it could be innocent, because the server may have been rebuilt or its host key rotated.

DANGER

Never tick the box and continue just to get past the warning. If the change is an attack, your password and everything you type go to the attacker.

What to do:

  1. Tap Abort connection.

  2. Ask yourself, or the server's owner, whether something happened that would change the key: the server was reinstalled, rebuilt from an image, moved to new hardware, or its SSH keys were regenerated. A cloud server that was destroyed and recreated at the same address also gets a new key.

  3. Get the new fingerprint from a trusted source, as for a first connection.

  4. Connect again. If the Offered now fingerprint matches the one you were given, tick I verified this new key with the server owner and tap Trust new key.

  5. If you cannot explain the change, or the fingerprints differ, do not connect. Try from a different network, and tell the server's owner.

A changed key also stops automatic reconnects and commands run on many servers, rather than going ahead quietly.

Review or forget trusted keys ​

Open Settings › Known hosts to see every trusted key, with the date it was added. Tap one to copy its fingerprint, or choose Forget. The next connection to that server is treated as a first connection again and asks you to verify its key.

You can do the same from the host list: ⋮ › Forget host keys.

The list of trusted keys is sealed with a key held in your device's protected storage. If the app finds the list was tampered with or cannot be checked, it says so and each server asks you to verify its key once more.

Next steps ​