Verify SHA256 SSH RSA key fingerprint

As of OpenSSH 6.8 the defaults is to display base64 encoded SHA256 hashes for SSH host keys, whereas previously it showed MD5 hex digests. While this is a good move for security, it's a PITA to verify host keys now, especially on systems with older OpenSSH.

For systems with modern OpenSSH, you can just ask for the sha256 version:

ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub -E sha256

If you have old ssh, you need to work it out yourself:

awk '{print $2}' /etc/ssh/ssh_host_rsa_key.pub | base64 -d | sha256sum -b | awk '{print $1}' | xxd -r -p | base64

On OS X, same thing but with slightly different options:

awk '{print $2}' /etc/ssh/ssh_host_rsa_key.pub | base64 -D | shasum -a 256 -b | awk '{print $1}' | xxd -r -p | base64

Or if you have access to the server by another means you can get the server to tell you the MD5 fingerprint:

ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub -E md5