SSH Host Key Scan — What Key a Server Is Presenting
This retrieves the public host keys an SSH server presents and reports their fingerprints. Those keys are how clients recognise a server across connections, and the warning users see when one changes is the only protection SSH offers against connecting to an impostor.
Why run it
Two practical reasons. The first is provisioning: distributing verified host keys in advance means users are not trained to accept unknown keys, which is the habit that makes the warning useless. The second is verification after any rebuild — a legitimately reinstalled server presents a new key, and knowing that in advance prevents the alternative, where a fleet of users all press yes to a warning they have learned to ignore.
Why automate it
A host key should never change without a rebuild. That makes it an excellent thing to watch, because any unexplained change is either an undocumented rebuild or something considerably worse — a man-in-the-middle, or a host replaced by something that is not yours. Automated scanning that records fingerprints and alerts on change gives you that detection centrally, instead of relying on individual users to notice a warning and, crucially, to report it rather than clicking through.
What it gives you
Turns SSH's host key warning from a per-user annoyance into a monitored control. It is also the practical way to keep a verified key inventory so that users never have to decide whether an unknown key is safe.