an hour ago
Scanning ssh.railway.com (66.33.22.3) repeatedly with ssh-keyscan -t ed25519 ssh.railway.com, about one scan in six returns an ed25519 key other than the usual one, and that other key changes between scans.
A client that pins the usual key then fails that connection with SSH's host key warning, and passes on a retry a minute later.
Could you confirm which host keys ssh.railway.com legitimately serves, and publish their fingerprints in the docs so clients can pin them?
1 Replies
Status changed to Awaiting Railway Response Railway • about 1 hour ago
an hour ago
Host keys on ssh.railway.com can change at any time without notice, so a different key showing up is expected rather than something that needs reporting each time.
The endpoint is served by multiple hosts, each with its own key, and those hosts change routinely. That means it can present several different host keys at the same time, and which one you see depends on which host answers that connection.
We don't publish host key fingerprints, a known_hosts entry, or an SSHFP record for ssh.railway.com, and we can't confirm whether a specific fingerprint is ours. Because the keys aren't stable, pinning a single key will keep producing the host key warning you're seeing.
Status changed to Awaiting User Response Railway • about 1 hour ago