ansible / ansible/pylibssh

Use standard SHA256 fingerprints

Open
#701 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Cython
Stars
79
Forks
47
Avg merge
1d 11h
Merged PRs (30d)
6

Description

Currently, the code in `_load_server_publickey()` in session.pyx makes SHA1 + hex fingerprints. The OpenSSH normally uses SHA256 + base64 these days. They are ugly and longer, but they are default in OpenSSH so needed when one needs to compare them with output from the ssh-keygen.

It should not be breaking change as the fingerprint should be just the user facing information and not a API.

We should probably move this FIXME into an issue on the tracker.

_Originally posted by @webknjaz in https://github.com/ansible/pylibssh/pull/597#discussion_r2023501660_

Contributor guide

Open the contributing guide

Research direction

Start in session.pyx at _load_server_publickey(), where the current SHA1 and hexadecimal fingerprint is generated. Compare the expected result with ssh-keygen output, and consider any existing fingerprint coverage nearby. Done means the user-facing fingerprint uses SHA256 and base64, matching the standard OpenSSH representation.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.