What is the SHA256 that comes on the sshd entry in auth.log?

Question

When logging in via ssh, it can be seen the following on auth.log:

Dec 14 16:29:30 app sshd[22781]: Accepted publickey for dev from XXX.XXX.XX.XXX port XXXXX ssh2: RSA SHA256:pO8i...

I've been trying to figure out what is this SHA256 information, but I couldn't find anything that seems to match. First I thought it could be some information from the client (public key, fingerprint, hashed hostname etc) I'm connecting from, but I didn't find anything to confirm, neither at the server side.

The closest information I've found is here, but I didn't understand when it says "And here is an example using a key for authentication. It shows the kewy (a misspelling, probably) fingerprint as a SHA256 hash in base64.", since I haven't found a corresponding key fingerprint of any kind.

Thank you.

Joshua Griffiths · Accepted Answer · 2020-01-09T13:40:49.823

50

This is the SHA256 hash for the RSA public key which was used to authenticate the SSH session.

This is how to verify it:

ssh-keygen -lf .ssh/id_rsa.pub

Or, to verify without ssh-keygen:

Remove the ssh-rsa prefix
Decode the key to bytes using base64
Get the SHA256 hash for the key (as bytes, not hex)
Encode the bytes using base64

For example:

cat .ssh/id_rsa.pub    |
    awk '{ print $2 }' | # Only the actual key data without prefix or comments
    base64 -d          | # decode as base64
    sha256sum          | # SHA256 hash (returns hex)
    awk '{ print $1 }' | # only the hex data
    xxd -r -p          | # hex to bytes
    base64               # encode as base64

edited Jan 09 '20 at 13:40

answered Dec 15 '17 at 13:51

Joshua Griffiths

2,202
15
19

12

It turns out that you can use `ssh-keygen -lf .ssh/id_rsa.pub` – Joshua Griffiths Oct 26 '18 at 09:58
2

I think your comment is a separate and all-round better answer, which you should add separately. – Hugh W Dec 20 '18 at 17:30
1

+1 to adding `ssh-keygen -lf .ssh/id_rsa.pub` as a separate answer. It is better then manual encoding. – Illia Bobyr Jan 11 '19 at 18:19
1

Just an additional information: the same command works well with authorized_keys: *ssh-keygen -lf .ssh/authorized_keys* – Nopius Aug 23 '22 at 06:02

score 3 · Answer 2 · answered Aug 01 '18 at 14:03

Had the same question on macOS 10.13.6, where your answer just needed a couple of tweaks:

cat .ssh/id_rsa.pub    |
    awk '{ print $2 }' | # Only the actual key data without prefix or comments
    base64 -D          | # decode as base64
    shasum -a 256      | # SHA256 hash (returns hex)
    awk '{ print $1 }' | # only the hex data
    xxd -r -p          | # hex to bytes
    base64               # encode as base64

Thanks v. much.

What is the SHA256 that comes on the sshd entry in auth.log?

2 Answers2