Known hosts & fingerprints
How host keys are verified on first connect, what a changed fingerprint means, and how to forget one.
Known hosts & fingerprints
Every SSH server proves its identity with a host key. Kubexer Terminal remembers each server's key the first time you connect and checks it every time after, like OpenSSH's known_hosts. If the key ever changes, you're warned before anything is sent.
First connection
The first time you connect to a host, the connection overlay asks you to Verify the fingerprint. It shows the key type and its SHA-256 fingerprint.
- If you can, compare it with the fingerprint from the server's admin or console (
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pubon the server). - Click Accept & continue to trust it and add it to the vault's known hosts, or Cancel.
With a jump chain, each hop has its own key, and the prompt names the hop you're confirming.
When a fingerprint changes
If a server presents a different key, the overlay says The fingerprint for host has changed in red. This happens after a server is rebuilt or its keys are regenerated, but it can also mean someone is intercepting the connection.
Only continue if you expected the change:
- Replace — trust the new key instead of the old one.
- Add as new — trust the new key alongside the old one.
- Cancel — don't connect.
Manage known hosts
Open a vault → Known hosts to see every fingerprint you've accepted for that vault. Open one for details, and use Forget this key to remove it. The next connection then asks you to verify the host again.
Unattended connections never prompt
Port forwards, and other connections that run without a terminal, verify host keys strictly and never ask. If a host's key hasn't been accepted yet, they fail with has not been accepted yet. Open a terminal to that host once and accept its fingerprint, then try again.