Scan an SSH Key Through an Existing Proxy Relay

Gather candidate host keys through a local TCP relay while preserving the distinction between the relay’s label and the real SSH host.

ssh-keyscan does not accept SSH’s ProxyCommand option. A proxy configured for ssh therefore does not automatically configure the separate scanner.

One arrangement is an already established local TCP relay that completes the required proxy authentication and CONNECT exchange, then exposes the intended SSH server’s byte stream. If that relay listens on 127.0.0.1:2222:

ssh-keyscan -p 2222 127.0.0.1 > candidate.keys
ssh-keygen -lf candidate.keys

The first command gathers candidate keys; the second displays their fingerprints. The relay must pass the SSH stream after consuming the complete proxy response, rather than handing HTTP headers to the scanner.

The output’s host label describes the local relay endpoint. Do not append it unchanged and assume it now identifies the remote SFTP hostname.

Verify the fingerprint through a trusted record or administrator before associating the key with the real host and port in known_hosts. ssh-keyscan collects what the reachable endpoint presents; a successful proxy connection does not authenticate that key.

Artiglyn mynjee