Krdytkyu

I'm trying to SSH to my server, and the client is asking about the authenticity of the host.

ECDSA key fingerprint is SHA256:bla bla bla

With every version of OpenSSH I've used, ECDSA (or RSA) keys were shown something like

a7:3h:75:5d:si:9v:3g...

On Ubuntu 16.04 they're being shown like

c2ymd4uGIG3y34R78BcrykBVT...

I have another way to access the server, and I'm trying to verify the fingerprint by running ssh-keygen -lf ssh_host_ecdsa_key.pub. But this outputs something like 2048 a7:3h:75:5d:si:9v:3g.... Even ignoring the colons, they don't match. I can't be 100% positive this isn't because of a MITM attack, but it's highly unlikely.

How can I verify the key signatures? All the solutions I've found seem to deal with a different version of ssh-keygen, though I can't figure out what version I have, or what others have.

You can use ssh -o FingerprintHash=md5 user@host to use old-school MD5 hashes, or store this in your ~/.ssh/config:

FingerprintHash md5

You server is probably using old openssh version which does not support new sha256 hashses.

While the accepted answer solves the problem of forcing newer clients to show MD5 hashes, it doesn't specifically solve the problem of forcing a server to show its fingerprint with a specific hash function when calculating fingerprints on the server. To clarify that a bit, when checking fingerprints, you need to match the one shown on the client to the true value on the server. @Jakuje's answer deals with getting the client to use a different hash function, this answer deals with getting the server to show you the hash using a different hash function. It doesn't matter whether you change the server or the client's hash function, just so they're the same.

To find a host's fingerprint, on that host execute:

# Works with the version of OpenSSH on 16.04 but not 14.04

# (on 14.04 I have OpenSSH_6.6.1p1; on 16.04 it's OpenSSH_7.2p2)

# Check your version with with `ssh -V`

cd /etc/ssh

ssh-keygen -l -E md5 -f ssh_host_ecdsa_key.pub

Of course, you can change md5 to any supported hash function, and you may need to change ssh_host_ecdsa_key.pub depending on the key type you're using (e.g. ssh_host_rsa_key.pub).