Securely Obtain Your SFTP Host Key: A Step-by-Step Guide

Updated at: 24/06/2025

Securely connecting to your SFTP server requires verifying its host key. This crucial step prevents man-in-the-middle attacks. This guide provides a clear, step-by-step process for obtaining and securely storing your SFTP host key, regardless of your operating system or SFTP client. Learn how to avoid common pitfalls and ensure your connection remains safe and reliable. Let's get started!

Step-by-Step Instructions

  1. Prepare your environment

    • Open your command prompt (Windows) or terminal (macOS).
    Open your command prompt (Windows) or terminal (macOS).
    Prepare your environment

  2. Run the ssh-key-scan command

    • Use the `ssh-key-scan` command followed by the SFTP server's fully qualified domain name (FQDN) or IP address.
    • `ssh-key-scan -p <port_number> <hostname>`
    If using a non-standard port (other than port 22), add `-p` followed by the port number before the hostname. For example: `ssh-key-scan -p <port_number> <hostname>` If using a non-standard port (other than port 22), add `-p` followed by the port number before the hostname. For example: `ssh-key-scan -p <port_number> <hostname>`
    Run the ssh-key-scan command

  3. Retrieve the host key

    • `hostname encryption key base64 value`
    • Carefully copy the `base64 value` (the host key) from the command's output. Do not include the command itself, extra lines, or whitespace.
    Carefully copy the `base64 value` (the host key) from the command's output. Do not include the command itself, extra lines, or whitespace. Carefully copy the `base64 value` (the host key) from the command's output. Do not include the command itself, extra lines, or whitespace.
    Retrieve the host key

  4. Configure your SFTP client

    • Access your SFTP configuration settings (the video mentions a 'toolbox menu', 'system setup', and 'SFTP configuration').
    • Paste the copied `base64 value` into the designated 'host key' field within your SFTP configuration.
    Paste the copied `base64 value` into the designated 'host key' field within your SFTP configuration. Paste the copied `base64 value` into the designated 'host key' field within your SFTP configuration.
    Configure your SFTP client
[RelatedPost]

Tips

  • Verify that your workstation can access the SFTP server before running the command.
  • Double-check that you only copy the host key itself and avoid any extra characters or spaces.

Common Mistakes to Avoid

1. Downloading the host key from an untrusted source

Reason: Downloading the host key from a website or email that isn't officially associated with the SFTP server exposes you to man-in-the-middle attacks and the risk of downloading a malicious key.
Solution: Always obtain the host key directly from the SFTP server during the initial connection.

2. Ignoring host key verification warnings

Reason: Dismissing warnings about a fingerprint mismatch indicates that the host key you have might be different from the server's actual key, potentially resulting in a connection to a malicious server.
Solution: Verify the host key fingerprint against the one provided by the server administrator or a trusted source.

3. Improperly storing the host key

Reason: Storing the host key insecurely, such as in plain text or in an easily accessible location, makes it vulnerable to theft or compromise, enabling attackers to impersonate the server.
Solution: Store the host key securely using a password manager, encrypted file system, or dedicated key management tool.

FAQs

What is an SFTP host key, and why is it important?
An SFTP host key is a cryptographic key unique to your server. Verifying it ensures you're connecting to the correct server and not a malicious imposter trying to intercept your data. Without verification, your connection is vulnerable to man-in-the-middle attacks.
How do I know if my SFTP client has already stored the host key?
Most SFTP clients will automatically store the host key after the first successful connection. Check your client's settings or documentation to see where host keys are stored. If you're unsure, it's best to follow the steps in this guide to obtain and verify the key.
What should I do if I get a host key mismatch warning?
A host key mismatch means the server's key has changed. This could be legitimate (e.g., a server update) or malicious. Do NOT proceed unless you can independently verify the new key's authenticity. Contact your server administrator to confirm the change before proceeding.