21

I got this message today when trying to log into my server. What should I do? Whats going on?

$ ssh 10.10.10.69
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
3d:1b:02:9e:b2:b8:f0:f7:c6:4f:94:96:f6:e3:c0:d1.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending key in /root/.ssh/known_hosts:8
RSA host key for 10.10.10.69 has changed and you have requested strict checking.Host key verification failed.
  • 2
    As an aside, you may wish to avoid logging in locally and remotely as root, and instead use non-privileged users combined with sudo. – Steve Beattie Nov 18 '10 at 19:48
12

Did you recently reinstall the OS on your server or anything like that? That would cause this.

To fix this: http://www.cyberciti.biz/faq/warning-remote-host-identification-has-changed-error-and-solution/

Solution #1: Remove keys using ssh-keygen

Use the -R option to removes all keys belonging to hostname from a known_hosts file. This option is useful to delete hashed hosts. If your remote hostname is server.example.com, enter:

$ ssh-keygen -R {server.name.com}
$ ssh-keygen -R {ssh.server.ip.address}
$ ssh-keygen -R {ssh.server.ip.address} -f {/path/to/known_hosts}
$ ssh-keygen -R server.example.com

Now, you can connect to the host without a problem.

Solution #2: Add correct host key in /home/user/.ssh/known_hosts

It is not necessary to delete the entire known_hosts file, just the offending line in that file. For example if you have 3 server as follows.

myserver1.com,64.2.5.111 ssh-rsa  
 AAAAB3NzaC1yc2EAAAABIwAAAIEA11FV0EnGahT2EK8qElocjuHTsu1jaCfxkyIgBTlxlrOIRchb2pw8IzJLOs2bcuYYfa8nSXGEcWyaFD1ifUjfHelj94AAAAB3NzaC1yc2EAAAABIwAAAIEA11FV0E
nGahT2EK8qElocjuHTsu1jaCfxkyIgBTlxlrOIRchb2pw8IzJLOs2bcuYYfa8nSXGEcWyaFD1ifUjfHelj94H+uv304/ZDz6xZb9ZWsdm+264qReImZzruAKxnwTo4dcHkgKXKHeefnBKyEvvp/2ExMV9WT5DVe1viVw
    k=
    myserver2.com,125.1.12.5 ssh-rsa
 AAAAB3NzaC1yc2EAAAABIwAAAQEAtDiERucsZzJGx/1kUNIOYhJbczbZHN2Z1gCnTjvO/0mO2R6KiQUP4hOdLppIUc9GNvlp1kGc3w7B9tREH6kghXFiBjrIn6VzUO4uwrnsMbnAnscD5EktgI7fG4ZcNUP 5+J7sa3o+rtmOuiFxCA690DXUJ8nX8yDHaJfzMUTKTGxQz4M/H2P8L2R//qLj5s3ofzNmgSM9lSEhZL/IyI4NxHhhpltYZKW/Qz4M/H2P8L2R//qLj5s3ofzNmgSM9lSEhZL/M7L0vKeTObue1SgAsXADtK3162a/Z6MGnAazIviHBldxtGrFwvEnk82+GznkO3IBZt5vOK2heBnqQBf
    w=
    myserver3.com,125.2.1.15 ssh-rsa 
 5+J7sa3o+rtmOuiFxCA690DXUJ8nX8yDHaJfzMUTKTGx0lVkphVsvYD5hJzm0eKHv+oUXRT9v+QMIL+um/IyI4NxHhhpltYZKW
 as3533dka//sd33433////44632Z6MGnAazIviHBldxtGrFwvEnk82/Qz4M/H2P8L2R//qLj5s3ofzNmgSM9lSEhZL/M7L0vKeTObue1SgAsXADtK3162a/Z6MGnAazIviHBldxtGrFwvEnk82+GznkO3IBZt5vOK2heBnqQBfw==

To delete 2nd server (myserver.com), open file:

# vi +2 .ssh/known_hosts

And hit dd command to delete line. Save and close the file. Or use following

$ vi ~/.ssh/known_hosts

Now go to line # 2, type the following command

:2

Now delete line with dd and exit:

dd
:wq

Or you can use the sed command as follows to delete offending key at line # 44:

$ sed -i 44d ~/.ssh/known_hosts

Solution 3: Just delete the known_hosts file If you have only one ssh server

$ cd
$ rm .ssh/known_hosts
$ ssh ras.mydomain.com

Try connecting with ssh again
Now you should be able to connect your server via ssh:

ssh username@server-ip-here
ssh nixcraft@server1.cyberciti.biz

Next, you will get a fresh prompt to add key to ~/.ssh/known_hosts as follows:

The authenticity of host '10.86.115.66 ()' can't be established.
ECDSA key fingerprint is 4e:10:42:39:53:85:7f:89:89:dc:89:84:8d:79:e7:ed.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.86.115.66' (ECDSA) to the list of known hosts.
  • 9
    Note that if you did NOT change your server's SSH host keys, you should not replace your copy of the host key, as it may be a sign that someone is attempting to subvert your communications by performing a man-in-the-middle attack. – Kees Cook Oct 28 '10 at 16:16
7

From what I can tell, all these answers are about suppressing the warning, instead of dealing with it. In short, the warning is telling you that the server doesn't look like it used to look; see https://en.wikipedia.org/wiki/Man_in_the_middle_attack for why this may be a danger.

Read man ssh, especially this section:

VERIFYING HOST KEYS

When connecting to a server for the first time, a fingerprint of the server's public key is presented to the user (unless the option StrictHostKeyChecking has been disabled). Fingerprints can be determined using ssh-keygen(1):

   $ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key

To be on the safe side, you (or someone you trust) should have run this command first on the server you are connecting to. It will give you a fingerprint looking sort of like the one given in the warning in the question. Of course, often you don't have this info, but if you have reason to suspect something is up, running that command is the way to check if the server signature has really changed, or if there may be something suspicious going on.

  • 1
    Use this if your host provides a sha256 fingerprint instead of a md5 hash. ssh -o FingerprintHash=md5 example.org – Declan McKenna Dec 22 '16 at 11:15
  • 1
    More on FingerprintHash: superuser.com/questions/929566/… (ie. sha256 should be preferred, but you might not know that value if you haven't upgraded recently enough) – unhammer Dec 22 '16 at 12:36
2

I faced the same problem, and if you do not wish to delete the entireknown_hosts file, you can execute the following command:

ssh-keygen -R 10.10.10.69

There is no problem with deleting the known_hosts. You will only have to add each server you connect to, to the list each time you connect to them. Might screw up your scripts too, because the hosts are not yet trusted. The alert occurs when the signature of the host (the computer you are trying to connect to generated new keys, usually because of a re-install, or key rotation.)

0

If you believe that warning a false positive, you can delete your /root/ssh/known_hosts to start a new verifications.

  • 3
    Please don't do this, you will lose the other known hosts. Instead, if you are sure it is a false positive then delete the specific line: "known_hosts:8" line 8 in this case. – Roger Light Dec 1 '10 at 12:37
0

If you've recently reinstalled the server, or otherwise changed the host key, it's probably safe to remove line 8 from your ~/.ssh/known_hosts file and re-add the server (by ssh'ing to it, and answering "yes" when it asks for key verification)

0

As your server is on a local network, you can be quite confident.

If you reinstalled your system, this is normal, but instead of removing your known_hosts file, I'd recommand doing echo "" > ~/.ssh/known_hosts

  • People can still play tricks on a local network. Business or School networks could have a lot of room for not being trustable. – Azendale Jun 12 '11 at 6:37
0

ssh -q does this trick also.

0

Copy this line, but put in the username and hostname/IP for user and remote-server:

ssh-keygen -f "/home/user/.ssh/known_hosts" -R remote-server

For example:

ssh-keygen -f "/home/dev1/.ssh/known_hosts" -R 192.168.199.108

And paste it on your local terminal and run it. This worked for me.

0

On the client node where you are issuing the ssh,

vi ~/.ssh/known_hosts

Delete all lines that start with IP addresses that are on the same network as the IP you are trying to ssh into. This will force the client node to permenently add (ECDSA) to the list of known hosts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.