Question

Display SSH fingerprint (after first boot)

Fingerprints are currently displayed in the console only at the first boot.

How am I on a later occasion supposed to know I’m connecting to the intended host without the fingerprint to verify with?

Using public key infrastructure (PKI) doesn’t protect against a man-in-the-middle (MITM) attack when someone has my public key and can route me to another server. I’d have to verify the server in another way. It may often be unlikely an adversary manages to construct an environment that fools me to believe it’s mine, but that’s not an acceptable verification method.

Workaround

  1. Add SSH key at creation. Using a password without having verified fingerprint lets a MITM relay the traffic and monitor or modify your session. With PKI you can be misrouted to a deceptive environment, but not directly compromise the intended target server.
  2. Login using SSH key.
  3. Set root password to something sufficiently unique and secure.
  4. Open web console.
  5. Login using new root password.
  6. Successful login should confirm you’re on that server.

Fix

Display the fingerprints in both hex and Base64 of applicable algorithms either in the control panel or configure Droplets to show them in console every boot.

Relevant

There’s another thread asking for fingerprints through the API.

On another note, you can avoid the risk of sending the root login credentials over email if you instead send a link where the person has to login to DigitalOcean in order to receive the password (making sure they’re in control of both email and account). But those who care to that degree may use PKI.


Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.

This is the simplest fix I could thought about when using already existing concepts

https://github.com/lucaszanella/digital-ocean-fingerprint-fix

Hey Jooize,

This may not answer your question fully, but as far as:

“How am I on a later occasion supposed to know I’m connecting to the intended host without the fingerprint to verify with?”

Your SSH client handles this for you with its ‘known_hosts’ (or equivalent) file.

For example, if using PuTTY on windows to SSH into your droplet, the first time you SSH in, PuTTY will prompt you that "The server’s host key is not cached in the registry. You have no guarantee that the server is the computer you think it is’. If you select yes to this prompt, after confirming once that the fingerprint is correct, it stores that value in the Windows registry [HKEY_CURRENT_USER\SoftWare\SimonTatham\PuTTY\SshHostKeys]. If you were to then SSH into your droplet again with PuTTY, and someone was doing a MITM to a different server, PuTTY would not let you connect, stating that the attackers host that you are being redirected to doesn’t have the same fingerprint that is stored in the registry (making it so you don’t have to remember the fingerprint and check it yourself every time).

SSH on Linux / MacOS uses a similar technique, but rather saves in the info in ~/.ssh/known_hosts or /etc/ssh/known_hosts.

TL;DR: your SSH client caches the fingerprint on first connection and will warn you if it changes.