Skip to main content

RECORD SSH HOST KEY FINGERPRINTS FOR A FLEET

This guide shows you how to collect each host's SSH host public key and SHA256 fingerprint as Swamp data, so that you can compare and audit the keys later.

Prerequisites

  • swamp auth login completed
  • SSH access to the target hosts with a key available to ssh-agent or an identity file

Pull the extension

swamp extension pull @swamp/ssh

You will see output like:

INF extension·pull: Pulling "@swamp/ssh"@"2026.10.13.1"
INF extension·pull: Identity verified: "@swamp/ssh"@"2026.10.13.1"
INF extension·pull: Pulled "@swamp/ssh"@"2026.10.13.1"
INF extension·pull: Extracted 14 files:

Declare the fleet

Create a @swamp/ssh behavior named edge-fleet (see Create and Run a Behavior). Set strictHostKeyChecking to accept-new so the first connection to a host that is not yet in known_hosts can succeed:

globalArguments:
  name: edge-fleet
  transport:
    kind: ssh
    user: ops
    port: 22
    auth:
      kind: key
    strictHostKeyChecking: accept-new
    connectTimeoutSec: 10
    extraOptions: []
    controlMaster:
      enabled: true
      persistSec: 600
  hosts:
    - name: edge-1
      address: 198.51.100.21
      tags: [edge]
      attrs: {}
    - name: edge-2
      address: 198.51.100.22
      tags: [edge]
      attrs: {}

If your known_hosts entries are already in place, set strictHostKeyChecking to yes instead.

Write the host records

swamp behavior run edge-fleet apply

This command writes a host resource for each fleet member, so the collected keys can be read alongside the host records.

Collect the host keys

swamp behavior run edge-fleet collect-host-public-key \
  --input hosts=all \
  --input hostKeyPath=/etc/ssh/ssh_host_ed25519_key.pub

This command reads and validates each host's public key file and writes one hostPublicKey resource per host, containing the raw key line, the algorithm and the SHA256 fingerprint.

To collect a different key type, point hostKeyPath at that file. For example, use /etc/ssh/ssh_host_rsa_key.pub for RSA. To collect from some of the hosts only, replace all with a tag such as edge or a cel: selector.

Compare later collections

Run the collection again after a rebuild or on a schedule. Each run writes a new version of each host's hostPublicKey resource, so a changed fingerprint shows up as a difference between versions. See Query and Manage Data for reading versions, and Run Workflows on a Schedule to repeat the collection.