Host key checks

Every SSH server has a key that proves it's really that server. FusionTerm checks it on every connection, so nobody can quietly put another machine in its place (a "man-in-the-middle" attack).

#First connection: "Trust this host?"

The first time you connect to a server, FusionTerm shows its key fingerprint (it starts with SHA256:) and asks whether to trust it. If you can, compare it with the fingerprint your server administrator gives you — on the server, ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub shows it. Accept, and FusionTerm remembers it for your account.

If you don't answer, the connection is refused — FusionTerm never connects to a server it hasn't checked. With jump hosts, every hop is checked.

#"Host key changed"

If a server's key is different from the one you trusted, FusionTerm blocks the connection and shows both fingerprints.

• Expected? The server was reinstalled, rebuilt or its SSH keys were regenerated: accept the new key.
• Not expected? Don't connect. Ask the server's administrator — someone may be intercepting the connection.

#Managing trusted keys

Settings → Trusted SSH host keys lists every server whose key you've approved. Forget one to be asked again next time — for example after a server was legitimately reinstalled.

Trusting, replacing and rejecting keys are all recorded in the audit log.