fingerprint: What's the syntax?

[simmel]

I've tried all sorts of versions of using the fingerprint:

SHA256:Bbf[…]
RSA SHA256:Bbf[…]
domain.tld RSA SHA256:Bbf[…]
AAAAB3Nz[…]=
ssh-rsa AAAAB3Nz[…]=
ssh-rsa AAAAB3Nz[…]= root@domain.tld
domain.tld,192.0.2.1 ssh-rsa AAAAB3Nz[…]=

But nothing seems to work. What should the syntax be and can it be documented?

[timmkroe]

I have the same issue. An example would be nice.

[philo23]

After a lot of trial and error I discovered the correct format is just <hash algo>:<fingerprint> eg: SHA256:Bbf…

To get the actual fingerprint itself, you can either:

• Temporarily comment out the host from your ~/.ssh/known_hosts file, then try connecting to the server with the same identity file you're trying to use in the ssh-action. The fingerprint will be displayed in the warning message (just remember to uncomment it afterwards...)

  The authenticity of host '[<host ip>]:<host port> ([<host ip>]:<host port>)' can't be established.
  ECDSA key fingerprint is <hash algo>:<fingerprint>.
  Are you sure you want to continue connecting (yes/no/[fingerprint])?
  

  If you do use this method, one thing to watch out for is the trailing . on the end of the fingerprint line, it is not part of the fingerprint itself.
• The other way is to run on the server you're trying to connect to ssh-keygen -l -f <file> against the SSH host keys found (at least on Ubuntu) in /etc/ssh/, there will probably be several depending on your hosts supported key formats, the filename will follow this kind of format ssh_host_<key format>_key.pub where is probably either rsa or ed25519
  That will print out something along these lines:

  username@hostname:~$ ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub
  256 <hash algo>:<fingerprint> root@hostname (ECDSA)
  

  You only need the <hash algo>:<fingerprint> portion of the output.

[nicklasfrahm]

@philo23 Do you mind if I basically copy and paste this into a PR?

[philo23]

Yeah no problem from me.

I suspect the second method is the proper way to do it, but the first bullet point is much easier for someone unfamiliar with SSH to do.

[nicklasfrahm]

@philo23 I can hack a one-liner together. I found out that the easiest way to do it is to connect to the VM or server and then attempt to connect to itself. Then you don't need to mess with the known_hosts.

[kenjis]

<hash algo>:<fingerprint> does not work. Why?
See #275

[METACEO]

@nicklasfrahm @philo23 it'd be great for ssh-action to report which hash algo it's failing against. I've tried multiple <hash algo>:<fingerprint> combinations in my setup but my action keeps failing. The ssh: host key fingerprint mismatch error stops short re. providing info to resolve the issue.