The first connection
The first time you connect to a server, the app asks Trust this server? and shows the address, the key type and the fingerprint of its host key.
- Read the fingerprint of the server from its console, or ask its administrator:
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub - If it is the same, choose Trust and connect. If not, choose Cancel.
A server has one key for each type. To list them all:
for f in /etc/ssh/ssh_host_*_key.pub; do ssh-keygen -lf "$f"; doneSaved fingerprints
Fingerprints lists the keys you trusted, with the server, the type and the fingerprint. They sync with your vault. Remove one and the app asks again on the next connection.
When a key changes
If a server presents a key that differs from the saved one, the app stops before signing in and shows Connection stopped, with the saved key and the key now. See The server's key changed.
Import known_hosts
To bring in the keys you already trust with OpenSSH, choose Import ~/.ssh/known_hosts in Fingerprints on Mac, or Import known_hosts file on iPhone and iPad. A fingerprint already saved stays as it is.
Connection details and key exchange
In the session menu, More, then Connection details shows the key exchange in use and whether it is post-quantum. To choose it for a server, open Show more, Network and jumps, Key exchange: Post-quantum first, the default, Post-quantum only, or Classic only for an old server that misbehaves.