Known hosts

How the app checks each server's identity, and how to manage the keys it trusts.

Why it matters

A host key proves you’re talking to the server you meant to, not to someone in between. The app checks it on every connection, including each jump host along the way.

• First connection: the app shows the server’s key type and fingerprint and asks. Trust and Connect saves it to Known Hosts; Don’t Trust cancels.
• The key changed: the connection stops. There’s no button to continue. If the change is expected (the server was rebuilt, say), delete the old entry in Known Hosts and connect again to be asked afresh, after checking the new fingerprint with the server’s administrator.

Known hosts sync with your vault, so a server you’ve trusted on one device is trusted on all of them. They’re shared by all your vaults.

Add or import keys

• Import: choose OpenSSH’s known_hosts file. Plain host names are imported; hashed and wildcard entries are counted and left out.
• By hand: paste a known_hosts line or a .pub key. Check the fingerprint with the server’s administrator before trusting a key this way.
• New Host from This… on a known host starts a new host with its name and port filled in.

Algorithms

The app uses current algorithms only: it doesn’t offer SHA-1 key exchange, ssh-rsa (SHA-1) or DSA host keys, or CBC ciphers. A very old server that supports nothing newer won’t connect.