Hacker News Reader

Oh, the server fingerprint I have ignored literally tens of thousands of times in my life?

I don't turn it off, because I like the warning, but dhcp has made me completely blind to server keys.

You can search `known_hosts` for a fingerprint using `ssh-keygen -l -f ~/.ssh/known_hosts` and `grep`. If you disable `HashKnownHosts` in your ssh config, the command will also tell you the name of the host(s) for that fingerprint, rather than its hash.

I use this all the time, because my AWS/Azure/GCP ips change constantly, but their pubkey fingerprints do not.

[1] https://www.schneier.com/blog/archives/2005/05/the_potential...

If you connect by constant server name, dhcp shouldn't invalidate TOFU.

Reply on news.ycombinator.com