Verify SSH host keys

DevOpsPad verifies every SSH server before it sends credentials. It accepts the server only if its host key is in a known_hosts file (by default ~/.ssh/known_hosts) or matches a Host key fingerprint in SHA256:… format that you enter. Unknown or changed keys fail with an error; there is no “trust on first use” prompt.

Pick one method per connection. When a fingerprint is entered, the Known hosts file field is disabled and only the fingerprint is used.

Option 1: known_hosts (default)

Leave Known hosts file empty to use ~/.ssh/known_hosts, the file OpenSSH maintains. If you have already connected to the server with ssh in Terminal and accepted its key, nothing else is needed.

To add a server without logging in, fetch its keys and check the fingerprint with your administrator before trusting it:

ssh-keyscan -p 22 bastion.example.com > /tmp/bastion.keys
ssh-keygen -lf /tmp/bastion.keys          # compare these fingerprints
cat /tmp/bastion.keys >> ~/.ssh/known_hosts

Servers on a non-standard port are stored as [bastion.example.com]:2222; ssh-keyscan -p 2222 writes them in that form. Hashed known_hosts entries work too.

To use a different file, for example a team-managed known_hosts, type its path or click the folder button. ~/ paths are expanded.

Option 2: SHA256 fingerprint

Ask the administrator for the server’s host key fingerprint. On the server they can print it with:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Copy the part that starts with SHA256: (43 characters follow the prefix) into Host key fingerprint. DevOpsPad compares it with the key the server presents during the handshake.

Steps

1. In the connection dialog, enable Connect through SSH tunnel.
2. Leave Known hosts file empty, choose a file, or fill in Host key fingerprint.
3. Click Test connection.

Errors

Message	Meaning	Fix
Cannot read SSH known_hosts; choose a file or enter a verified SHA256 host fingerprint	The file does not exist or cannot be read	Create it with ssh-keyscan, choose another file, or use a fingerprint
SSH host key verification failed …: knownhosts: key is unknown	The server is not in the file	Add it, after checking its fingerprint
SSH host key verification failed …: knownhosts: key mismatch	The file has a different key for this host	Confirm with the administrator, then replace the old entry (ssh-keygen -R host)
SSH host key does not match the configured fingerprint	Fingerprint differs	Check for typos; confirm it belongs to the key type the server presents
SSH host fingerprint must use SHA256 format	Wrong format	Use SHA256: plus 43 characters, not an MD5 fingerprint

If ssh in Terminal works but DevOpsPad reports a mismatch, your known_hosts may hold only one of the server’s key types. Adding all of the server’s keys with ssh-keyscan usually fixes it. See SSH troubleshooting.

Frequently asked questions

Can I accept an unknown host key the first time I connect?

No. DevOpsPad never trusts a presented key automatically. Add the server to known_hosts or enter its SHA256 fingerprint first.

What does a changed host key mean?

The server presented a different key than the one you trusted. It may have been rebuilt, or someone may be intercepting the connection. Confirm with the server administrator before updating known_hosts.