Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I got this message today when trying to log into my server. What should I do? Whats going on?

$ ssh 10.10.10.69
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
3d:1b:02:9e:b2:b8:f0:f7:c6:4f:94:96:f6:e3:c0:d1.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending key in /root/.ssh/known_hosts:8
RSA host key for 10.10.10.69 has changed and you have requested strict checking.Host key verification failed.
share|improve this question
1  
As an aside, you may wish to avoid logging in locally and remotely as root, and instead use non-privileged users combined with sudo. –  Steve Beattie Nov 18 '10 at 19:48

7 Answers 7

up vote 8 down vote accepted

Did you recently reinstall the OS on your server or anything like that? That would cause this.

To fix this: http://www.cyberciti.biz/faq/warning-remote-host-identification-has-changed-error-and-solution/

share|improve this answer
    
yes I did. Thanks I will look into that! :) –  myusuf3 Oct 27 '10 at 18:53
5  
Note that if you did NOT change your server's SSH host keys, you should not replace your copy of the host key, as it may be a sign that someone is attempting to subvert your communications by performing a man-in-the-middle attack. –  Kees Cook Oct 28 '10 at 16:16

From what I can tell, all these answers are about suppressing the warning, instead of dealing with it. In short, the warning is telling you that the server doesn't look like it used to look; see https://en.wikipedia.org/wiki/Man_in_the_middle_attack for why this may be a danger.

Read man ssh, especially this section:

VERIFYING HOST KEYS

When connecting to a server for the first time, a fingerprint of the server's public key is presented to the user (unless the option StrictHostKeyChecking has been disabled). Fingerprints can be determined using ssh-keygen(1):

   $ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key

To be on the safe side, you (or someone you trust) should have run this command first on the server you are connecting to. It will give you a fingerprint looking sort of like the one given in the warning in the question. Of course, often you don't have this info, but if you have reason to suspect something is up, running that command is the way to check if the server signature has really changed, or if there may be something suspicious going on.

share|improve this answer

If you believe that warning a false positive, you can delete your /root/ssh/known_hosts to start a new verifications.

share|improve this answer
2  
Please don't do this, you will lose the other known hosts. Instead, if you are sure it is a false positive then delete the specific line: "known_hosts:8" line 8 in this case. –  Roger Light Dec 1 '10 at 12:37

I faced the same problem, and if you do not wish to delete the entireknown_hosts file, you can execute the following command:

ssh-keygen -R 10.10.10.69

There is no problem with deleting the known_hosts. You will only have to add each server you connect to, to the list each time you connect to them. Might screw up your scripts too, because the hosts are not yet trusted. The alert occurs when the signature of the host (the computer you are trying to connect to generated new keys, usually because of a re-install, or key rotation.)

share|improve this answer

If you've recently reinstalled the server, or otherwise changed the host key, it's probably safe to remove line 8 from your ~/.ssh/known_hosts file and re-add the server (by ssh'ing to it, and answering "yes" when it asks for key verification)

share|improve this answer

As your server is on a local network, you can be quite confident.

If you reinstalled your system, this is normal, but instead of removing your known_hosts file, I'd recommand doing echo "" > ~/.ssh/known_hosts

share|improve this answer
    
People can still play tricks on a local network. Business or School networks could have a lot of room for not being trustable. –  Azendale Jun 12 '11 at 6:37

ssh -q does this trick also.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.