Cannot use "ecdsa" and "rsa" in parallel when using SFTP

Question

When I connect to my "OpenSSH_8.2p1 Ubuntu-4ubuntu0.4" server alternating using

sftp -v -o HostKeyAlgorithms=ecdsa-sha2-nistp256 test-user@localhost

and

sftp -v -o HostKeyAlgorithms=rsa-sha2-256 test-user@localhost

I always get when switching from one algorithm to the other the following warning:

"WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" 

Is this the correct behavior that it is not possible to use ECDSA and RSA Host-Key-Algorithms in parallel, or is this a bug?

Answer 1

SSH (ssh and other programs that run it, such as scp and sftp) stores its keys in ~/.ssh/known_hosts by default. It identifies hosts by their keys.

In this case, you presumably have one of those keys (ECDSA or RSA) stored in that file and your SSH configuration (~/.ssh/config or else the system-wide copy in /etc/ssh/ssh_config or a similar location) is using StrictHostKeyChecking (see its entry in ssh_config(5)).

When you connect to the other one, run it like this (correct the key algorithm if I guessed it wrong):

sftp -v -o HostKeyAlgorithms=rsa-sha2-256 -o StrictHostKeyChecking=ask test-user@localhost

Ask is the default for this setting. With it enabled, you should then be prompted to save the second key. You won't need it in subsequent connections since both keys will be saved.

Answer 2

This is normal behavior. An SSH server is identified by its public key. An SSH server can only have multiple public keys if they're keys of different types (RSA, ECDSA, EdDSA, …). Normally, a given client machine always uses the same key type when talking to a given server (based on the client and server's support list and preferences), so the client always sees the same server key.

You're simulating the use of different SSH clients on the same machine, one that only supports RSA and one that only supports ECDSA. These clients see different server identities. But they share the same known_hosts file that stores the client's memory of server identities. Let's say you use the RSA client first. It sees that localhost has a certain RSA public key, asks you to check whether this is correct, and when you say “yes”, it records the key in ~/.ssh/known_hosts. Then, when you run the ECDSA client, it receives the server's ECDSA public key, which does not match what is stored in ~/.ssh/known_hosts. This indicates that something is deeply wrong: possibly an attack, possibly some misconfiguration, possibly that the server has been legitimately reinstalled. The SSH client has no way to know which one it is, so it lets you know and aborts the connection attempt.

If you have different SSH client software on the same machine that don't support the same public key algorithms, you need to make them use different known_hosts files. OpenSSH does not support having multiple public keys corresponding to the same server, which makes sense since it would be extremely rarely useful but would be very easy to accidentally misuse.