bugtraq - Re: SSH host key fingerprint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 2 Sep 2014 11:50:24 +0100
From: Jamie Riden <jamie.riden@...il.com>
To: Lukasz Biegaj <l.biegaj@...shock.pl>
Cc: bugtraq@...urityfocus.com
Subject: Re: SSH host key fingerprint - through HTTPS

If your HTTPS is not being MiTMed as well... (or the edge case - if it
is not John Leo doing the MiTMing of your SSH connection :)

If you trust Mr Leo *and* you know what that HTTPS cert should look
like, it may be of use. Personally, I'd rather do it more out-of-band
than this, but could be handy in a pinch I guess.

cheers,
 Jamie

On 2 September 2014 07:38, Lukasz Biegaj <l.biegaj@...shock.pl> wrote:
> W dniu 01.09.2014 o 17:16, Chris Nehren pisze:
>
>> It's Monday and I haven't had my tea yet, so maybe I'm missing something.
>> What is it?
>
>
> It rules out the possibility, that your ssh connection is being MITMed. If
> key reported by your ssh client is different than key reported by this
> website, then you shouldn't bother server admin with it, as the issue is in
> your network.
>
>
> --
> Łukasz Biegaj
>



-- 
Jamie Riden / jamie@...eynet.org / jamie.riden@...il.com
http://uk.linkedin.com/in/jamieriden