Documentation/content/security/ssh-fingerprint.md
Otto Richter 2bda61e74d Diverse changes (#189)
a bunch of (typo) fixes, additions, rewordings

Update references

- remove mentions of the master branch, as it's removed for many repos
and might change in the future for others (fixes some dead links)
- remove mentions of moved repos with our official examples
- some on-the-fly additions or rewordings

Close #186 foobar->examples

Co-authored-by: fnetx <git@fralix.ovh>
Co-authored-by: fnetX <git@fralix.ovh>
Reviewed-on: https://codeberg.org/Codeberg/Documentation/pulls/189
Co-authored-by: Otto Richter <fnetx@noreply.codeberg.org>
Co-committed-by: Otto Richter <fnetx@noreply.codeberg.org>
2022-01-21 11:36:38 +01:00

1.8 KiB

eleventyNavigation
key title parent order
SSHFingerprint Verifying you're connected to Codeberg using SSH fingerprints Security 30

When you connect to Codeberg via SSH, for example to clone or commit, you need to make sure that you're actually connected to Codeberg's servers and not someone else's server attempting to execute a so-called man-in-the-middle attack.

To protect you against this sort of attacks, SSH will ask you the first time you connect to a new server, whether you want to trust that server:

$ git clone git@codeberg.org:Codeberg/Documentation
Cloning into 'Documentation' ...
The authenticity of host 'codeberg.org (159.69.0.178)' can't be established.
ECDSA key fingerprint is SHA256:T9FYDEHELhVkulEKKwge5aVhVTbqCW0MIRwAfpARs/E.
Are you sure you want to continue connecting (yes/no/[fingerprint])? 

When connecting to Codeberg, it is important that you check the displayed fingerprint against one of the following fingerprints published by Codeberg:

SHA256:6QQmYi4ppFS4/+zSZ5S4IU+4sa6rwvQ4PbhCtPEBekQ codeberg.org (RSA)
SHA256:T9FYDEHELhVkulEKKwge5aVhVTbqCW0MIRwAfpARs/E codeberg.org (ECDSA)
SHA256:mIlxA9k46MmM6qdJOdMnAQpzGxF4WIVVL+fj+wZbw0g codeberg.org (ED25519)

These are the SHA256 versions of the fingerprints published in the Imprint, which are to be considered the authoritative fingerprints for Codeberg.

If they match, you're good to go and can safely use Codeberg via SSH.

If they don't, don't continue to connect, because your credentials may be at risk and please give us a heads-up at contact@codeberg.org.