Argthtjtr

So given the following assumptions:

1) I wish to ssh to a remote host for the first time

2) ssh-keyscan shows this:

pwaugh$ ssh-keyscan -t ecdsa pi                                      

# pi:22 SSH-2.0-OpenSSH_7.4p1 Raspbian-10+deb9u4 pi ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEQVybySS0o5UWGHC0Qq1/pkDWZ0gK4nxUDdQEGdxWo3Dl5XMfMr+m6l5GDo7eID23j3N5Gwh7pGyea3WQbRWAk= pwaugh$

3) ssh pi@pi gives me this:

pwaugh$ ssh pi@pi

The authenticity of host 'pi (192.168.1.12)' can't be established.

ECDSA key fingerprint is SHA256:eMaAlpPMA2/24ajrpHuiL7mCFCJycZNfuNfyB3cyx+U.

Are you sure you want to continue connecting (yes/no)? no

Host key verification failed.

pwaugh$

QUESTION #1:
How can I confirm the SHA256 hash of the key returned from the server with ssh is the equivalent of the full key returned by ssh-keyscan?

(other than on the terminal $ sudo ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key)

I'm guessing that if this were possible, it would leave me open to a man-in-the-middle attack, unless I eventually did verify it on the terminal, right?

I'm also guessing that a better method would just be gather the keys, add them to known_hosts, and then let ssh verify them for me anyway. But just curious.

QUESTION #2:
When connecting for the first time, and getting the confirm host message/key, it defaults to the ecdsa key. Is this less secure than using the ed25519 key? Can I force it to check that key? (Probably have to delete other host keys I'm guessing)

Thanks for any thoughts. I've reviewed the man files, and even a book on ssh, and just unclear on this.

Patrick

Where 'pi' is the host of interest, I can request the keys, and then pipe them to ssh-kegen as follows:

$ ssh-keyscan pi | ssh-keygen -lf -

# pi:22 SSH-2.0-OpenSSH_7.4p1 Raspbian-10+deb9u4

# pi:22 SSH-2.0-OpenSSH_7.4p1 Raspbian-10+deb9u4

# pi:22 SSH-2.0-OpenSSH_7.4p1 Raspbian-10+deb9u4

256 SHA256:eMaAlpPMA2/24ajrpHuiL7mCFCJycZNfuNfyB3cyx+U pi (ECDSA)

2048 SHA256:P/Da4p1YbLDgnbGIkVE9SykONlVynPkwwap54RMW6+A pi (RSA)

256 SHA256:cpQtotFCbt4TXxa1474whR1Wkk3gOczhumE23s9pbxc pi (ED25519)

$ _

This is so that I don't have to physically do this on the host:

$ ssh-keygen -lf ./.ssh/known_hosts

Patrick