SSH host keys for SFTP and SCP

When you connect to a Simple FTP Service over SFTP or SCP, the server presents an SSH host key. Verifying its fingerprint proves you are talking directly to DocEvent's servers and not to a man-in-the-middle.

The host key fingerprints

Every Simple FTP Service region presents the same RSA host key:

2048 SHA256:vgxrsQY4LuABBPrAIdBHQSF+UQgF5PuWzsqtLYSAua4 (RSA)
2048 MD5:f3:d6:0d:1d:a0:98:33:4f:b5:ef:f3:0d:e5:e5:e4:9f (RSA)

This applies to sfs-us-east-1.docevent.io, sfs-eu-west-1.docevent.io and sfs-ap-southeast-2.docevent.io, and to the static-sfs-<region> hostnames.

The full host public key, if you want to pre-seed your known_hosts file:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjg6TG3+z+ejP+0DJQvStED4oCwGtpO4juHuUkrd+YTVr7FYer/pufkP4DY5Xqk0/ZiGArbDSrsuSW1WCr7PSFNyMSOC/yus0omUNpxbJs/mblVryJ8k/KT9Vf62zeFJPrCP/uog3rlSlvs/13c8CLBW80tafPNeELakbMuVG+J9tChuqVm3DwlX2HqnPch7MYG8AhqSMHmsn+qWtwSiaidwhqA+Mo6qWAmz0Hs9D9IVkkwRysV7weJLZE2KJjQ/Qf8wnT2knxQvUwqTKBlhG4G81JuDIE1+3n6+aK9ZAGWJxECgKwd0jsmsAdO9AAfXziGKKq3ib7xtsQppDsOknx

Verifying on first connection

The first time you connect, your SSH client shows the fingerprint and asks you to confirm it:

$ sftp serviceid/username@sfs-ap-southeast-2.docevent.io
The authenticity of host 'sfs-ap-southeast-2.docevent.io' can't be established.
RSA key fingerprint is SHA256:vgxrsQY4LuABBPrAIdBHQSF+UQgF5PuWzsqtLYSAua4.
Are you sure you want to continue connecting (yes/no)?

Check that the fingerprint matches the one above, then answer yes. The key is stored in your known_hosts file and you will not be asked again for this hostname.

"Warning: the RSA host key has changed"

The host key never changes - if your client reports that it has, do not continue the connection:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!         @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

A changed fingerprint means your traffic is being routed to a server that is not DocEvent's - typically altered DNS or a compromised network path. Investigate before entering credentials, and contact support if you cannot explain it.

"IP address has changed" warnings

Our servers run in auto-scaling clusters across multiple instances, so the IP address behind the hostname legitimately changes between connections. Some SSH clients pin the IP as well as the hostname and warn about this.

The host key is your identity anchor, not the IP address. Tell your client to check only the key:

sftp -o CheckHostIP=no 'serviceid/username@sfs-us-east-1.docevent.io'

Or permanently, in ~/.ssh/config:

Host *.docevent.io
    CheckHostIP no

If your firewall needs fixed addresses, connect via static-sfs-<region>.docevent.io and see Static IP addresses and ports.