Skip to content

SSH Host Key

Each server has an SSH host key. The server shows this key to every SSH client, and the client uses it to make sure that it talks to the correct server.

Appliku records the host key of your server at the first connection. At each later connection, Appliku compares the key that the server shows with the recorded key. You can see the recorded key on the server page, in Basic Details, as SSH Host Key.

When the key changes

If the server shows a different key, Appliku does not connect to the server. Deployments, commands, server stats and other operations that use SSH fail until a team member checks the new key and accepts it.

When this occurs:

  • The server page shows the card SSH host key changed, with the accepted key and the new (offered) key.
  • Each member of the team gets one email.

Why the key can change

A key change is usually normal. Some examples:

  • An upgrade script or a hardening script made new host keys on the server.
  • An OpenSSH upgrade added or removed a key type.
  • The server was restored from a backup or a snapshot to a new instance.

A key change can also be an attack: someone is in the network path between Appliku and your server, and shows their own key. For this reason, Appliku does not accept a new key automatically.

Note

If you reinstalled the server, remove it from Appliku and add it again. The reinstall also removed the Appliku setup from the server.

How to check the key

Look at the key on the server itself, and compare it with the offered key on the card.

Use the provider console, not SSH

Open a terminal on the server through the web console of your provider, for example the Hetzner Console, the DigitalOcean Droplet Console, or the AWS EC2 Serial Console or Session Manager. Do not use SSH for this check: if someone is in the network path, an SSH connection can go to their machine, and that machine shows their own key.

In the console, run this command:

for f in /etc/ssh/ssh_host_*_key.pub; do ssh-keygen -lf "$f"; done

The command reads the public host keys of the server and shows the fingerprint of each one. It does not change anything. The output looks like this:

256 SHA256:Xk3v9aR1...Qp0 root@myserver (ECDSA)
256 SHA256:pL7wq2Mn...Zt4 root@myserver (ED25519)
3072 SHA256:b8YcT5Ks...Hw1 root@myserver (RSA)

Each line shows the key size, the fingerprint (SHA256:...), a comment, and the key type.

Find the line that has the same fingerprint as the Offered key on the card. The offered key type on the card is the SSH name of the type, for example ssh-ed25519 for ED25519, ecdsa-sha2-nistp256 for ECDSA, and ssh-rsa for RSA.

Accept or reject

  • The fingerprint is the same: click Accept the new key on the card, and confirm. Appliku records the new key and connects to the server again.
  • No line has the same fingerprint: do not accept the key. Contact Appliku support.

After you accept the key, start the deployments that failed again. Appliku does not run them again automatically.