ALC-1003: Unknown SSH host key

The SSH server you tunnel through presented a host key this machine has never trusted. Alcuin stopped before sending it any password, passphrase or agent signature, because it cannot yet tell whether this is the right server.

What you see

In the connection form, after Test connection, the heading reads Couldn't open the SSH tunnel and the message reads:

The SSH server bastion.example.com is not one this machine knows. Its key's fingerprint is SHA256:…: check it with whoever runs the server, then trust it in the connection's settings.

For a port other than 22 the server is named as [bastion.example.com]:2222. Below the message, Server key shows the fingerprint, with a Trust this key button.

The first time: compare the fingerprint, then Trust this key.

In the launcher, after Connect, you see the same message without the button.

Why it happens

• This is the first time you connect to this SSH server from this machine, and its key is in neither ~/.ssh/known_hosts nor the connection’s settings.
• The server is in known_hosts under another name. Alcuin looks it up by the host and port as typed in SSH host and SSH port, so an alias, an IP address or another port counts as a different server.
• known_hosts lists the server only through a wildcard or negated pattern, such as *.example.com. Alcuin matches exact names and hashed entries only.
• known_hosts trusts the server only through a host certificate authority (an @cert-authority line). Alcuin does not use those lines, so the server’s key looks unknown.

What to do

1. Ask whoever runs the SSH server for its key’s fingerprint, through a channel you already trust. On the server, ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub prints it; the file name depends on the key type.
2. Compare it with the fingerprint Alcuin shows. Both use the SHA256: form.
3. If they match, click Trust this key. Alcuin keeps the fingerprint in the connection’s settings, where it shows as Trusted server key, and tests again.
4. Click Save to keep it.

If you saw the message in the launcher, right-click the connection and choose Edit…, then click Test connection in the form and follow the steps above. The menu’s own Test connection… reports the failure but does not offer Trust this key.

If the fingerprints do not match, do not trust the key. Tell whoever runs the server.

You can also accept the key with ssh in a terminal first. Alcuin reads ~/.ssh/known_hosts, including hashed entries, and trusts a key listed there for the same host and port.

To stop trusting a key you trusted in Alcuin, click Forget beside Trusted server key and save.

Internal name

The engine reports this as ENGINE_SSH_HOST_UNKNOWN. Quote either name in an issue.