My understanding of a RSA fingerprint is that it basically is a hash a key.My understanding of a forwarded port is per the following section of man ssh: -R [bind_address:]port:host:hostport         Specifies that the given port on the remote (server) host is to         be forwarded to the given host and port on the local side.  This         works by allocating a socket to listen to port on the remote         side, and whenever a connection is made to this port, the connec         tion is forwarded over the secure channel, and a connection is         made to host port hostport from the local machine.When using ssh to connect to a forwarded port, what is the RSA key fingerprint a hash of?  Using identical RSA authentication keys on multiple machines will describe why I am asking.Or through example, what are the two fingerprints below actually of?RSA key fingerprint is 94:21:d2:fc:70:2d:8d:bb:71:30:0f:4d:52:49:01:43.RSA key fingerprint is b2:5b:19:25:91:50:3c:45:73:c7:7e:4f:da:c3:f6:f3.Getting first fingerprintMachine 1sshtunnel@pi_one:~ $ ssh -R 2222:localhost:22 sshtunnel@192.168.1.10Common Machine[sshtunnel@devserver ~]$ ssh -p 2222 sshtunnel@localhostThe authenticity of host '[localhost]:2222 ([::1]:2222)' can't be established.RSA key fingerprint is 94:21:d2:fc:70:2d:8d:bb:71:30:0f:4d:52:49:01:43.Are you sure you want to continue connecting (yes/no)? noHost key verification failed.Getting second fingerprintMachine 2sshtunnel@pi_two:~ $ ssh -R 2222:localhost:22 sshtunnel@192.168.1.10Common Machine[sshtunnel@devserver ~]$ ssh -p 2222 sshtunnel@localhostThe authenticity of host '[localhost]:2222 ([::1]:2222)' can't be established.RSA key fingerprint is b2:5b:19:25:91:50:3c:45:73:c7:7e:4f:da:c3:f6:f3.Are you sure you want to continue connecting (yes/no)? noHost key verification failed.[sshtunnel@devserver ~]$
What does the RSA key fingerprint represent for a forwarded port?
ssh;ssh tunneling
The host's public keys in /etc/ssh/ssh_host_*_key.pub:$ ssh localhostThe authenticity of host 'localhost (::1)' can't be established.ECDSA key fingerprint is 60:6e:7a:10:85:a4:14:f1:37:44:88:17:29:67:b1:e1.Are you sure you want to continue connecting (yes/no)? ^C$ ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key256 60:6e:7a:10:85:a4:14:f1:37:44:88:17:29:67:b1:e1 /etc/ssh/ssh_host_ecdsa_key.pub (ECDSA)(Note that it doesn't matter if you ask ssh-keygen for a fingerprint of the private key (without the .pub extension), it automatically reads the corresponding public key instead.)In your case, it's the RSA key that is mentioned, so /etc/ssh/ssh_host_rsa_key.pub, and with the port forwarding, it's the host ssh eventually connects to. With newer versions of ssh-keygen, the default output is the base64-encoded SHA256 hash of the key. Adding the -E md5 option gives the hex-encoded MD5 hash (but note that now there's a prefix indicating the hash type):$ ssh-keygen -l -f /etc/ssh/ssh_host_ecdsa_key.pub256 SHA256:4+dfNAIjGq72HL9UeNEpne8J54yj/4wFpi+/4Bv7dhQ root@... (ECDSA)$ ssh-keygen -Emd5 -l -f /etc/ssh/ssh_host_ecdsa_key.pub256 MD5:3c:18:e7:9c:ee:e8:6a:38:7d:74:ef:2f:a5:51:ee:1a root@... (ECDSA)