News for hackers. Stuff that matters.

A comment on Signing .jars is not worth the effort. Parent comment

Re:Signing .jars is not worth the effort by vbezhenar on Sunday July 26, 2020 @06:14PM (#23960595)
Here's an approach that I'm using with small VPS providers. I'm using web remote access to install Linux (from pristine distribution ISO). That web remote access uses HTTPS, so I can be sure that all input/output is E2E protected from provider to my computer. After I install Linux, I boot it first time and access it using that HTTPS remove console. Then I'm running something like ssh-keygen -l -f /etc/ssh/ssh_host_ed2519.pub -E md5 (I might be wrong about this command, check mans before use, also it does not require root, so login under ordinary user) and I can see md5 hash of server ssh public key. I write it down (or rather print-screen), connect with Putty and verify it. I believe that this method provides as much chain of trust as possible.
[ Parent | on HN ]
Re:Signing .jars is not worth the effort by MaxBarraclough on Sunday July 26, 2020 @07:00PM (#23960822)
That's the approach I use with Linode. Unlike EC2 there's no browser-viewable system-log that shows the public key, but it can be retrieved using a web-based terminal session.

To find the fingerprint in PuTTY's obsolete format, the command I use is equivalent to the one you've given. It was provided in the ServerFault answer I linked:

     ssh-keygen -l -E md5 -f /etc/ssh/ssh_host_ed25519_key.pub
I don't like comparing fingerprints by eye, but PuTTY doesn't make it easy to do otherwise. This issue doesn't arise with PowerShell's OpenSSH client, where I can just copy the fingerprint (in the new format) to the clipboard. (It lacks features like mouse support though, so I prefer to use PuTTY.)

To find the fingerprint in the new format for OpenSSH, I believe the command is:

    ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub
> I believe that this method provides as much chain of trust as possible.

Yes, can't do better than that. If your HTTPS session with your VPS provider has been compromised, it's all over anyway.

[ Parent | on HN ]