node.js - The authenticity of host 'github.com (192.30.252.128)' can't be established

Question

I am trying to use

sudo npm install

to install all my dependencies for an application written in nodejs. My OS is Ubuntu 13.04

However, I keep getting this warning:

The authenticity of host 'github.com (192.30.252.131)' can't be established.
RSA key fingerprint is 16:27:ac:a5:76:28:1d:52:13:1a:21:2d:bz:1d:66:a8.
Are you sure you want to continue connecting (yes/no)?

Has anyone encountered this warning before? Is it possible to authenticate and store the fingerprint locally? So I won't need to authenticate again when I enter sudo npm install another time.

Right now, I am unable to enter anything, not even "yes". My terminal just gets stuck, i have to press ctrl+c to terminate.

Answer 1

Danger ahead, unless you actually don't care about secure communication with github on your local account

Ssh rightly complains that they can't make sure you are indeed connecting to github's server through a secure channel. That might be why github is recommending https access, which works out-of-the-box thanks to its public key infrastructure.

Now, you can have it work, but be aware that it involves caching a public key fingerprint which, if done incorrectly, provides an attacker permanent man-in-the-middle attack.

How to proceed safely?

Option 1 is use https url instead of ssh.

Option 2 is have ssh access work.

Okay, show me option 2

Do ssh -T [email protected] but don't just type "yes". Check if the hash that is shown matches one of the hashed shown in https://help.github.com/articles/what-are-github-s-ssh-key-fingerprints/ (in your question it does, and see, the page is fetched through https for the same public key infrastructure reasons).

If the hash matches, then connection is indeed safe you can answer "yes" to ssh's question.

Okay, I checked and typed yes, how do I know it works?

Ssh will show something like:

Warning: Permanently added the RSA host key for IP address '192.30.252.128' to the list of known hosts.

After that, you will either see a message like

Permission denied (publickey).

which is good but shows that you need further configuration, or simply

Hi yourlogin! You've successfully authenticated, but GitHub does not provide shell access.

which means that all works well and you can retry your first operation.

Notice that if you retry the same ssh command, it should no longer ask the question.