互联网基础服务之SSH——client远程连接server时，如何确保server目标正确

client远程连接server时，如何确保server目标正确
参见: 中间人攻击
1.此时无法确认192.168.178.125这台机器的真实性，但可以获取目标的指纹信息

[root@web01 ~]# ssh root@192.168.178.125 The authenticity of host
‘192.168.178.125 (192.168.178.125)’ can’t be established. ECDSA key
fingerprint is SHA256:nqseve0xtMMYMo/+w7jzHmMbYSzeNLkQSAb3t31w77Q.
ECDSA key fingerprint is
MD5:bb:0e:ce:b0:5d:c3:7b:f1:54:50:c3:2e:76:9f:c5:83. Are you sure you
want to continue connecting (yes/no)?

2.远程获取192.168.178.125公钥指纹信息
#扫描了公钥信息本身

[root@web01 ~]# ssh-keyscan 192.168.178.125 |grep ecdsa

# 192.168.178.125:22 SSH-2.0-OpenSSH_7.4 # 192.168.178.125:22
SSH-2.0-OpenSSH_7.4 # 192.168.178.125:22 SSH-2.0-OpenSSH_7.4
192.168.178.125 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMzD1Qz0iBweRMosfcB8bYZXwIXgvJltBoup6rjn0pXIExALtECoVqNTyyRr9cT2lSB4s9FhTINUK9raNZ0tB9E=

#扫描了公钥的指纹信息

[root@web01 ~]# ssh-keyscan -t ecdsa 192.168.178.125 | ssh-keygen -lf-

• # 192.168.178.125:22 SSH-2.0-OpenSSH_7.4
  256SHA256:nqseve0xtMMYMo/+w7jzHmMbYSzeNLkQSAb3t31w77Q 192.168.178.125
  (ECDSA)

3.对比指纹信息确认server身份

4.核对正确，登录

Are you sure you want to continue connecting (yes/no)? yes

5.可以登录server机器后查看公钥指纹信息

[root@web02 ~]# ssh-keygen -E SHA256 -lf
/etc/ssh/ssh_host_ecdsa_key.pub 256
SHA256:nqseve0xtMMYMo/+w7jzHmMbYSzeNLkQSAb3t31w77Q no comment (ECDSA)

6.再次对比server机器的公钥指纹信息确认server身份