Verify the host key

The first time you connect to a new server, SSH shows you a fingerprint and asks a question:

The authenticity of host '203.0.113.10 (203.0.113.10)' can't be established.
ED25519 key fingerprint is SHA256:wQ2vT9xk8mR0lHq3sJ7bN1cP4fD6eA8gK5iM2oU0yXs.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Almost everyone types yes. I want you to stop and think about what that prompt can and cannot tell you.

The fingerprint is a short hash of the server’s public host key. The problem is where it comes from. The same network that delivered the prompt also delivered the fingerprint. If someone sits between you and the server, they can show you their own key and it will look just as plausible. The prompt alone proves nothing.

Get the fingerprint another way

You need a second channel that does not pass through the network path you are about to trust. For a VPS the easiest one is the provider’s web console. Open it, log in on the console itself, and print the host key fingerprint from the server’s own disk:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

The output looks like this:

256 SHA256:wQ2vT9xk8mR0lHq3sJ7bN1cP4fD6eA8gK5iM2oU0yXs root@notes (ED25519)

Some providers also print the fingerprint in the dashboard or in the first-boot log. A teammate who built the server can paste it to you in chat. Any of those works, as long as it is not the SSH prompt itself.

Compare exactly, then answer

Now go back to your terminal and compare the whole string, not just the first few characters. If it matches, you can type yes. Better still, paste the fingerprint itself at the prompt. OpenSSH accepts a fingerprint as the answer and only continues if it matches:

Are you sure you want to continue connecting (yes/no/[fingerprint])? SHA256:wQ2vT9xk8mR0lHq3sJ7bN1cP4fD6eA8gK5iM2oU0yXs

If you paste the wrong value, SSH refuses and asks again. That is exactly the behavior you want.

Once accepted, the key is saved in ~/.ssh/known_hosts and you will not be asked again for this host. We look at that file in the next lesson.

The hostile case

Now pretend the console showed a different fingerprint. Change one character and paste it. SSH answers:

Please type 'yes', 'no' or the fingerprint: 

It does not let you in. That single refusal is the whole point of the exercise. Trust for the server identity comes from outside the connection, and SSH gives you a way to enforce it.

My habit: I never type yes to this prompt. I always paste the fingerprint from the console. It costs ten seconds and it removes the reflex entirely.