|
| 1 | +--- |
| 2 | +title: I am having trouble verifying Public Gateway SSH key fingerprints from Cockpit |
| 3 | +description: Learn how to verify Public Gateway SSH key fingerprints when they appear in different formats (SHA256 in Cockpit and MD5 in the console) and resolve confusion for accurate key matching |
| 4 | +tags: public-gateway ssh fingerprint cockpit logs sha1 md5 |
| 5 | +dates: |
| 6 | + validation: 2025-07-23 |
| 7 | + posted: 2025-07-23 |
| 8 | +--- |
| 9 | + |
| 10 | +## Problem |
| 11 | + |
| 12 | +You may check your Public Gateway's [SSH bastion](/public-gateways/how-to/use-ssh-bastion/) logs in [Scaleway Cockpit](/cockpit) and notice that the SSH key fingerprints logged there do not match the SSH key fingerprints shown in your [Project dashboard](https://console.scaleway.com/project/ssh-keys) in the Scaleway console. |
| 13 | + |
| 14 | +## Cause |
| 15 | + |
| 16 | +SSH key fingerprints are in `SHA256` format in Cockpit logs, but in `MD5` format in the console's Project dashboard. |
| 17 | + |
| 18 | +- `SHA256` computes a 256-bit hash value from the SSH key, represented as a 64 character hexadecimal number, often then Base-64 encoded. |
| 19 | + - Example: `SHA256:ZLqisKhPVs2R2jrpYlukWWMkbAdhD4zkUckc7L4/W5w` |
| 20 | +- `MD5` computes a 128-bit hash value from the SSH key, represented as a 32-character hexadecimal number. |
| 21 | + - Example: `MD5:d2:40:3d:de:67:9c:d3:fd:1e:20:a3:c2:c3:d2:25:69` |
| 22 | + |
| 23 | +## Solution |
| 24 | + |
| 25 | +You need access to the original public key in order to successfully cross-check the two sources. Depending on your situation, choose one of the solutions listed below. |
| 26 | + |
| 27 | +### Generate both fingerprint formats from a local public SSH key |
| 28 | + |
| 29 | +If you have the public SSH key stored on your local machine, you can use the `ssh-keygen` utility to generate both a `SHA256` and a `MD5` fingerprint of the key. You can then compare these fingerprints with those shown in Cockpit and the Scaleway console. |
| 30 | + |
| 31 | +<Message type="tip"> |
| 32 | +Use the following command to generate a `SHA256` fingerprint of the SSH key: |
| 33 | + |
| 34 | +```bash |
| 35 | +ssh-keygen -l -E sha256 -f ~/.ssh/id_rsa.pub |
| 36 | +``` |
| 37 | + |
| 38 | +Example output: |
| 39 | +```bash |
| 40 | +256 SHA256:ZLqisKhPVs2R2jrpYlukWWMkbAdhD4zkUckc7L4/W5w |
| 41 | +``` |
| 42 | + |
| 43 | +Use the following command to generate an `MD5` fingerprint of the SSH key: |
| 44 | + |
| 45 | +```bash |
| 46 | +ssh-keygen -l -E md5 -f ~/.ssh/id_rsa.pub |
| 47 | +``` |
| 48 | + |
| 49 | +Example output: |
| 50 | +```bash |
| 51 | +256 MD5:d2:40:3d:de:67:9c:d3:fd:1e:20:a3:c2:c3:d2:25:69 |
| 52 | +``` |
| 53 | +</Message> |
| 54 | + |
| 55 | + |
| 56 | +### Generate both fingerprint formats from a remote public SSH key |
| 57 | + |
| 58 | +If the public SSH key is stored on an accessible remote host, use the `ssh-keyscan` utility to get the key from the remote host. You can then examine the raw public key data and generate fingerprints in different formats as shown in the previous section, and compare these fingerprints with those shown in Cockpit and the Scaleway console. |
| 59 | + |
| 60 | +<Message type="tip"> |
| 61 | +Use the following command to get public key information from the `examplehost` server, and save it in a file called `examplehost.ssh-keyscan`: |
| 62 | + |
| 63 | +```bash |
| 64 | +ssh-keyscan examplehost >examplehost.ssh-keyscan |
| 65 | +``` |
| 66 | + |
| 67 | +You can examine the contents of the file with the following command: |
| 68 | + |
| 69 | +```bash |
| 70 | +cat examplehost.ssh-keyscan |
| 71 | +``` |
| 72 | + |
| 73 | +Example output, showing the `ECDSA`, `RSA`, and `Ed25519` public SSH keys for `examplehost`, each in their standard Base64-encoded format used for SSH authentication: |
| 74 | + |
| 75 | +```bash |
| 76 | +examplehost ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCNvbWhtAjN7Zqr4I0XMu9PqAnQmCIgjenCIzd7Tk6sWOJk0As+HYheam8G4Ks1lx630lkZ0bR7KWqxUxz5A+h4= |
| 77 | + |
| 78 | +examplehost ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDAYoaW8+I4H5CjHMaRpG239DK/gJteIDfpsd9jxQR2D6KVht3nNc3asfDafAhYA1JXduleJmSWPuWVC0+jTyEgnPzI4rFyTEomnyRBAoNbWWSJZ9djqhi5pVBWSxUDXEzeRlPVzKNUJnmYE5xpP14o3RXkRsGTnKdpbubKm1gX3O4ItfjTKKljkYLG5WKCaGx7gCdf5uV6jtNSvLDZubPP6wC60WT6Iuaq1kTGugPY+wiEYnlunK47TAXyIMCIgDxvZPAlnWpgBaRJ8ZUT2kW5Rta0AO6bPtZIRz+AABtDsRRKBsW9v6FoYY3Pxp09ynRG5XgW76Z4dG4kr70HoRtDBXm0c2gMyxxek6XvH7WbWR0pOqGyFNSbK8GoCvxk/JElIW20UswTGbjO5EjtHcsn5bSaqS6ASu/lS2rfsFZtY5X5NQGNMyGQNVaRspA8J0nRT0FHDBOgEfIHG3Uubp0zgei80mTElVCgf+ICdufp0d6LiW27seiJOq0Exd/i7os= |
| 79 | + |
| 80 | +examplehost ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDd6NscKr2BdwojZxWoN30sZpLVRVoQIrcXUd1pUfQOZ |
| 81 | +``` |
| 82 | + |
| 83 | +You can then use the commands shown in the [previous section](#generate-both-fingerprint-formats-from-a-local-public-SSH-key) to generate `SHA256` and/or `MD5` fingerprints of the public key: |
| 84 | + |
| 85 | +```bash |
| 86 | +## For SHA256: |
| 87 | +ssh-keygen -l -E sha256 -f examplehost.ssh-keyscan |
| 88 | + |
| 89 | +## Example output, where the second section shows the SHA256 fingerprint of the unhashed RSA public key |
| 90 | +256 SHA256:UxhErHbf4BtJWZ/BOuHJKDfjDfHcPVcHYvJUCdNQ7H8 (ECDSA) |
| 91 | +3072 SHA256:79CNwaJ+7+VURaVQDfFsoK3AL1K/3R9Ljv1qKv+PTvs (RSA) |
| 92 | +256 SHA256:DruvVmoX9chNwePv/8ezES8jLOQbgBJSkpZb+VNkuU8 (ED25519) |
| 93 | + |
| 94 | +## For MD5: |
| 95 | +ssh-keygen -l -E sha256 -f examplehost.ssh-keyscan |
| 96 | + |
| 97 | +## Example output, where the second section shows the MD5 fingerprint of the unhashed RSA public key |
| 98 | +256 MD5:1f:fa:de:02:fb:3c:34:0e:49:a6:29:7d:b1:7e:7a:af (ECDSA) |
| 99 | +3072 MD5:4c:1a:6e:0c:43:b2:18:1d:25:9f:7f:39:eb:59:f2:73 (RSA) |
| 100 | +256 MD5:09:e0:b6:fe:5f:e5:39:ce:5f:fb:54:42:48:6c:24:d9 (ED25519) |
| 101 | +``` |
| 102 | +</Message> |
| 103 | + |
| 104 | +### Compare fingerprint to trusted fingerprint |
| 105 | + |
| 106 | +A trusted fingerprint is one that you or your organization has verified to be legitimate. You may have a trusted fingerprint e.g. in a `known_hosts` file or a secure key management system. It may be in `SHA25` or `MD5` format. You can compare this trusted fingerprint to the fingerprint shown in either the Cockpit fingerprint or the console fingerprint, depending on the format. |
| 107 | + |
| 108 | +### Converting one fingerprint format to another |
| 109 | + |
| 110 | +It is not possible to convert a `SHA256` format fingerprint to an `MD5` format fingerprint, or vice versa, without the original public key. This is because these fingerprints are created with one-way hash functions. You must have the original public key in order to generate the desired fingerprint type from it, and compare with fingerprints shown in Cockpit or the Scaleway console. |
0 commit comments