3 ms·
Oh, the server fingerprint I have ignored literally tens of thousands of times in my life? I don't turn it off, because I like the warning, but dhcp has made m
by genewitch 5y ago
Oh, the server fingerprint I have ignored literally tens of thousands of times in my life?
I don't turn it off, because I like the warning, but dhcp has made me completely blind to server keys.
- GoblinSlayer 5y agoIf you connect by constant server name, dhcp shouldn't invalidate TOFU.
- not-elite 5y agoYou can search `known_hosts` for a fingerprint using `ssh-keygen -l -f ~/.ssh/known_hosts` and `grep`. If you disable `HashKnownHosts` in your ssh config, the command will also tell you the name of the host(s) for that fingerprint, rather than its hash. I use this all the time, because my AWS/Azure/GCP ips change constantly, but their pubkey fingerprints do not. [1] https://www.schneier.com/blog/archives/2005/05/the_potential_f.html https://www.schneier.com/blog/archives/2005/05/the_potential...