an hour ago
Hello Railway Support Team,
I am configuring secure SSH access to my Railway staging PostgreSQL service for a database backup and restore verification exercise.
When running railway ssh -- pg_dump --version from my Mac, I received the following SSH host authenticity prompt:
Host: ssh.railway.com
IP displayed: 66.33.22.3
Key type: ED25519
SHA256 fingerprint: SHA256:+S1xg92FrnHz6pY3bpkmh1OGtWQGNANXilPzlxA7B1g
Before accepting and trusting this host key, could an authorised Railway team member please confirm whether this is the current legitimate ED25519 SSH host key fingerprint for ssh.railway.com?
If this fingerprint is not correct, please provide the official fingerprint or a secure method to verify it.
Project: Ridevia Web Staging
Environment: staging
Service: ridevia-staging-postgres
Railway CLI version: 5.66.0
I have not accepted the host key or made any changes to the database.
Thank you for your assistance.
3 Replies
an hour ago
We don't confirm or verify individual host key fingerprints for ssh.railway.com, and we don't publish a fingerprint list, known_hosts entry, or SSHFP record for it.
Multiple hosts serve that endpoint, each with its own key, and those hosts change without notice. That means the fingerprint you see can differ between connections and will change over time. Seeing a new or different key there is expected and not a sign of a problem, so pinning a single fingerprint won't hold up. How you handle host key trust for this endpoint is your call.
Status changed to Awaiting User Response Railway • about 1 hour ago
Railway
We don't confirm or verify individual host key fingerprints for `ssh.railway.com`, and we don't publish a fingerprint list, known_hosts entry, or SSHFP record for it. Multiple hosts serve that endpoint, each with its own key, and those hosts change without notice. That means the fingerprint you see can differ between connections and will change over time. Seeing a new or different key there is expected and not a sign of a problem, so pinning a single fingerprint won't hold up. How you handle host key trust for this endpoint is your call.
an hour ago
Thank you for your response.
I understand that Railway uses multiple SSH hosts and does not publish fixed host key fingerprints.
However, I need a secure, officially recommended method to establish trust on the first SSH connection, rather than blindly accepting an unverified host key.
Could a Railway staff member please clarify:
- What is Railway's recommended secure procedure for first-time SSH host key verification?
- Is there a trusted source, host certificate authority, or alternative authenticated method available?
- If no such verification method exists, what secure alternative would you recommend for creating and exporting a PostgreSQL logical backup without exposing the database publicly?
I am using Railway CLI 5.66.0 on macOS with a private staging PostgreSQL service.
I would appreciate guidance from a Railway team member rather than an automated response.
Thank you.
Status changed to Awaiting Railway Response Railway • about 1 hour ago
39 minutes ago
To answer your questions in order: we don't have a recommended procedure for verifying the host key on a first connection, and there is no host certificate authority, SSHFP record, published known_hosts entry, or other authenticated channel for the ssh.railway.com host key. How you handle host key trust for that endpoint is up to you.
For a logical backup without exposing the database publicly: your PostgreSQL service is private by default and stays that way unless you add Public Access. Other services in the same project can reach it over private networking using the DATABASE_URL variable, which never leaves the project's private network.
Separately from logical dumps, our native volume Backups feature snapshots the database's volume without any public endpoint.
Status changed to Awaiting User Response chandrika • 39 minutes ago