Every change. Governed.Get started
Menu
/
On this page

GUIDES

Check an SSH host key

The first time AI NetShell connects to a device, it shows the device's SSH host-key fingerprint and asks you to trust it. Check that fingerprint against the device, and know what to do when a device is replaced.

Verified against AI NetShell 0.4.16

The first time AI NetShell opens an SSH session to a device, it asks you to trust that device's host key. The key is how SSH proves you reached the device you meant to reach, and not something in between. This guide shows what the prompt means, how to check the fingerprint against the device itself, and what to do when a device is replaced at the same address.

The example uses a Cisco IOS XE switch named C9K-CORE1. The key and fingerprint shown are examples, not a real device's.

What the prompt is asking#

On the first connection to a saved device, AI NetShell stops before it signs in and shows Unknown host key, with:

  • Device: the device's name, for example C9K-CORE1
  • Address: its address and port, for example 192.0.2.10:22
  • Key type: the kind of key the device offered
  • Fingerprint: a value that starts with SHA256:
  • the question "Trust this key and connect? Only if you recognize the device." with Trust and Cancel

The app shows one of these prompts at a time, even when you open several devices at once. Check that the device and address are the ones you opened, then check the fingerprint. Select Trust only when the fingerprint matches the value you got from the device or from the person who manages it. Select Cancel if you are not sure. AI NetShell does not sign in or send your credential until you trust the key.

After you trust it, AI NetShell saves the key for that saved device. Later connections check the key without asking. The SFTP browser uses the same saved key for that device and asks the same way when it has none.

Step 1: Read the key on the device#

Use a path you already trust: the console, or an SSH session you opened earlier from a known machine. On Cisco IOS and IOS XE, run:

text
show ip ssh

Near the end of the output, the device prints its public key:

text
IOS Keys in SECSH format(ssh-rsa, base64 encoded): TP-self-signed-1234567890
Modulus Size : 2048 bits
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5+hFKDS9/5FkjOnACBpZQxZrt/4x1j9KYZoA5EwRp
pa4Br5RljfESAZ3APKwQQhBWyOyc9ZMT7VExhv3jnZe0m0BWC0/8P9ille46B6DiCTRHzZ2ES3hAymkq
e9D/lV+HMy4kJC4E5qk0tKQdPyzeUXUYXFjHxVuQpAaJ6haYa9aC2nKGdZLjFbqPpi0i3CzH5eoKQQZl
yhETkakMUI7gxYwWpD4D/xzAHoE3tR/1uv+r9/tpJ+5etYmZjBZpR9uxuxRAla9NNH1onww3Umz+w2n2
M8ltxTUw9TuOfpMJFih/F64ZQ5ctYKvyKLAftjNaz5kuaLEi6ztHVwtDZgzv
IOS Keys in SECSH format(ssh-ec, base64 encoded): NONE

The switch wraps the key across several lines. Copy everything from ssh-rsa to the end of the key, then join it into one line: ssh-rsa, one space, and the key with no line breaks or spaces inside it.

If the ssh-ec line shows a key instead of NONE, copy that key too (it starts with ecdsa-) and join it the same way. The device can offer either key, so the fingerprint in the prompt matches one of them.

On other platforms, use the command that shows the device's SSH public key, or ask the administrator who manages the device for its SHA-256 host-key fingerprint.

Step 2: Turn the key into a fingerprint#

Save the one-line key in a text file on your PC, for example C9K-CORE1.pub. Then, in PowerShell, in the folder where you saved it:

text
ssh-keygen -lf .\C9K-CORE1.pub

It prints the key size, the fingerprint and the key type:

text
2048 SHA256:uknbI24VZ+RjvT5twgYwMro3YGnKZqmfryHzYDsFWnQ no comment (RSA)

ssh-keygen comes with the OpenSSH Client in Windows 10 and Windows 11. If PowerShell cannot find it, add OpenSSH Client under Settings > System > Optional features (Windows 10: Settings > Apps > Optional features).

Step 3: Compare and decide#

Compare the SHA256: value from Step 2 with the one in the prompt, character for character. Upper and lower case matter.

  • They match: select Trust.
  • They do not match: select Cancel. You may have reached a different device, a device behind the wrong VPN or path, or something that is intercepting the connection. Check the address and the path before trying again.

When a saved key no longer matches#

If a device you trusted before presents a different key, AI NetShell refuses the connection and shows Host key changed: "The connection was refused. This device offered a different key than the one saved. If it was replaced or rebuilt, forget the saved key and reconnect." It lists the device, its address, the Saved key and the Offered key.

There is no button to connect anyway. Close is the default, so pressing Enter never removes anything. Forget saved key… only removes the old key; it does not trust the new one.

Common reasons, from most to least likely:

  • You are on a different VPN or path, and it leads to a different device at the same address.
  • The device was replaced, reset or upgraded, and it generated a new key.
  • Someone regenerated the key on purpose, for example with crypto key generate rsa.
  • Something between you and the device is intercepting the connection.

Find out which one it is before you do anything else. Ask the person who manages the device, or check it from the console.

A device was replaced at the same address#

When you have confirmed that the device really was replaced or rekeyed, remove its saved key. There are two ways:

  • In the Host key changed dialog, select Forget saved key….
  • In the device list, right-click the device and select Forget saved SSH key….

Both open Forget saved key, which shows the device, its address and the saved key, and says "Next time you connect, you will check the new key." Type the device name exactly to confirm. If the name does not match, nothing is removed.

Then:

  1. Connect again. AI NetShell shows Unknown host key for the new key.
  2. Check the new fingerprint with Steps 1 to 3 before you select Trust.

Forgetting the key removes only the saved key you confirmed in the dialog.