Client Configuration
Server authentication is done during Diffie-Hellman key exchange through a
single public-key operation. When public-key authentication is used to
authenticate the server, the first connection is very important. During the
first connection the client will display a message similar to
the following:
Host key not found from database.
Key fingerprint:
xezop-fomas-lifot-pisoc-zyvik-hutoz-bafaf-zapyc-lubev-riked-dexax
You can get a public key's fingerprint by running
% ssh-keygen -F publickey.pub
on the keyfile.
Are you sure you want to continue connecting (yes/no)?
At this point, you should verify the validity of the fingerprint, for
example by contacting the administrator of the remote host computer
(preferably by telephone) and asking the administrator to verify that the key
fingerprint is correct. If the fingerprint is not verified, it is
possible that the server you are connecting to is not the intended one
(this is known as a man-in-the-middle attack).
After verifying the fingerprint, it is safe to continue connecting. The
server public key will then be stored on the client machine. The location
depends on the client implementation (on z/OS USS it is the
user's $HOME/.ssh2/hostkeys directory).
After the first connection, the local copy of the server public key will
be used in server authentication.
