Why do I need to use SshHostKeyFingerprint in WinSCP .NET assembly, when WinSCP GUI does not require such option?

Question

It is the first time I am using a WinSCP .NET client for uploading files from remote Linux PC. If I run following code without defining SshHostKeyFingerprint I get Error:

SessionOptions.Protocol is Protocol.Sftp or Protocol.Scp, but SessionOptions.SshHostKeyFingerprint is not set

So I think it is mandatory to define a SshHostKeyFingerprint, but I have no idea what to write here. When I connect to the same Linux PC with the known WinSCP Software Tool (protocol: SFTP), I just enter the hostname, username and password, and the connection is established. Why am I asked for the SshHostKeyFingerprint when I use my code? Where can I find the SshHostKeyFingerprint of the remote server?

try
{
    // Setup session options
    SessionOptions sessionOptions = new SessionOptions
    {
        Protocol = Protocol.Sftp,
        HostName = TagService.MAE_IP_PLC,                    
        UserName = "manufact",
        Password = "SUNRISE",
        //SshHostKeyFingerprint = "ssh-rsa 2048 xxxxxxxxxxx..." ???????????
    };

    using (Session session = new Session())
    {
        // Connect
        session.Open(sessionOptions);

        // Upload files
        TransferOptions transferOptions = new TransferOptions();
        transferOptions.TransferMode = TransferMode.Binary;

        TransferOperationResult transferResult;
        transferResult =
            session.PutFiles(@"c:\test\versions_840Dsl", "/card/siemens/versions.xml", false, transferOptions);

        // Throw on any error
        transferResult.Check();

        // Print results
        foreach (TransferEventArgs transfer in transferResult.Transfers)
        {
            Console.WriteLine("Upload of {0} succeeded", transfer.FileName);
        }
    }

    //return 0;
}
catch (Exception e)
{
    Console.WriteLine("Error: {0}", e);
    //return 1;
    using (StreamWriter sw = File.AppendText(CommonClass.error_path))
    {
        sw.WriteLine("WinSCP Error " + e + " " + Convert.ToString(DateTime.Now));
    }
}

Martin Prikryl · Accepted Answer · 2023-07-30T15:24:13.543

It's not true that WinSCP GUI does not require verification of the host key. Every decent SSH/SFTP client require that. Verifying the host key is integral part of securing SSH connection. You have probably only forgotten that you were asked by the GUI to verify the hostkey on the first connection.

Why do I need to use SshHostKeyFingerprint in WinSCP .NET assembly, when WinSCP GUI does not require such option?

1 Answers1