Host keys

Every SSH server has a host key that proves it’s the server you meant to reach. Termini checks it on every connection.

The first connection

The first time you connect to a server, Termini shows its key’s fingerprint and asks whether to trust it. If you can, compare it with the fingerprint from the server’s admin or console:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Once trusted, the fingerprint is remembered for that server — trust on first use, like OpenSSH’s known_hosts.

When a key changes

If a saved server later presents a different key, Termini stops and shows a blocking warning with:

• the previous fingerprint and the date it was first trusted,
• the new fingerprint, side by side.

The default button is Reject, so pressing Return out of habit can’t wave a possible attack through.

What to do:

• You expected it — the server was reinstalled, rebuilt or had its keys rotated: accept the new key.
• You didn’t — reject, and check the new fingerprint with the server’s admin through another channel before connecting again. An unexpected change can mean someone is intercepting the connection.

Your own keys

Settings → Keys lists the SSH keys in your ~/.ssh folder, once you’ve granted access to it.