3

I have recently upgraded my computer from ubuntu 12.04 to 14.04 LTS (in one step). After the upgrade, however, I got well-known warnings like

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The ECDSA host key for xxxx has changed,

, if I try to ssh into the computer from another linux computer.

If I try to log into the the computer from MinGW/Windows, which the host/server has a stored public key of, the login was successful for a few seconds and then the ssh session froze. The network for the host/server is down for about a few hours to a day, during which time I can't even ping the server. But it went back online again after that.

My question is: Is it possible/normal that a LTS upgrade like mine change the host key at all? Or is it more likely my computer is under man-in-the-middle-attack. How do I verify which is the case?

Thanks.

-- Update --

To try to fix the problem, I restored an Ubuntu 12.04 image that I made before the upgrade to 14.04 using fsarchive and a second Ubuntu installation. I did the recover many times before and never had a problem. But this time, after the recovery, the restored Ubuntu 12.04 wouldn't boot. I was left with a grub prompt.

Then, fixing grub, I used a liveusb to re-install grub (chroot, grub-install /dev/sda etc). Again, this fixes grub every time in the past but not this time. grub-install reports some error about "FlexNet" using sector 32.

I finally fixed grub after googling, and finding two lines of command to backup and wipe out the MBR. I don't know if anyone has had similar issue before. I never installed any software called FlexNet on my windows dual boot or Linux. And it happened only after I upgrade to 14.04 LTS. Is this a sign my computer was hacked?

After I fixed grub, I was able to upgrade again to 14.04 LTS, without any issue so far.

1

FlexNet is an anti-piracy software license manager software. It embeds some signature in sector 32 as a simple check to prevent people from copying it (because pirates would never figure out how to copy disk sectors). Because it is embedded in the drive header, the FlexNet signature will survive repartitioning etc. It is possible that someone installed the software previously on the drive, perhaps it once had Windows installed?

To blank the FlexNet sector:

sudo dd if=/dev/zero of=/dev/sda bs=512 count=1 seek=32

Regarding the ssh issue, see this answer where a user in a similar situation found that an upgrade added a line to sshd conf:

HostKey /etc/ssh/ssh_host_ecdsa_key

It is possible that the same happened to you - your server was using RSA/DSA keys, no ECDSA key was declared in the config (even if one did exist on the disk), but when you upgraded the server config was changed, and now ssh is complaining.

| improve this answer | |
  • Thanks. I'll verify the next time this happens. It's good to know that an upgrade might change ssh settings. I have been worried about security issues for a while. – tinlyx May 26 '14 at 1:48
0

Since you seem to have physical access to the machine in question, have it tell you what it's fingerprint is:

  • you@SuspiciousMachine $ sudo ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key

Compare that to what your linux machines are reporting and determine authenticity.

NOTE: Make sure you're printing the right key. In your case, you want ecdsa. Sometimes, this might be rsa, instead.

| improve this answer | |
  • Thanks, I will try this when I go to office, and get back to you. – tinlyx May 18 '14 at 1:08
  • I typed in ssh-keygen -lf ... physically on the machine, and the result matches what follows "The fingerprint for the ECDSA key sent by the remote host is: xxx". Does this mean that this is not man-in-the-middle-attack, and the key is just unchanged and I forgot about it? – tinlyx May 26 '14 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.