7

I've just tried to ssh connect to a server (auth via ssh key), and get the well-known message WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!. I'm the server administrator (but I'm not really a good server administrator) and does not change anything on this server. Another co-worker can go to this server (auth via ssh key too) and does not have the error. And another server can connect to this server (auth via ssh key).

So this only happens to me. I regenerate the key with ssh-keygen -R xxx.xxx.xxx.xxx, and now there is no problem. Everything is "fine" now, but I don't know if there is a security problem. Doing that, did I fix the man in the middle problem, or am I exposed? What should I do if so?

In other words, my question is: Should I panic?

One other side question: is it the right place to ask this kind of question?

P.S: Key type was ssh-rsa and is now ecdsa-sha2-nistp256. Don't know why, it's still ssh-rsa for my co-worker

2

I regenerate the key with ssh-keygen -R xxx.xxx.xxx.xxx

This is not a key regeneration! It is key removal from your known_hosts file. If there was man-in-the-middle, the attacker now can be authenticated to your server!

You should check the server keys from your machine and from your co-worker if it gives you the same set (good tool for getting all public ssh-keys from server is ssh-keyscan). It is normal that server has more different keys (and key types), but without knowing what was in your known_hosts file before you removed it, you have no chance to find out what caused the problem.

If you still have the old public key from known_hosts, before you removed it, check what key has your co-worker stored for that server and what are the actual keys on the server (preferably by physical access to the server, but also the ssh-keyscan can help). If it differs somewhere then you should investigate further your infrastructure or your machine and server, because then there can be some real problem.

  • Ok thanks! "without knowing what was in your known_hosts file before you removed it" -> I know what was in. What should I do with it? – rap-2-h Oct 19 '15 at 16:36
  • Compare with the current keys stored and with the real server keys. – Jakuje Oct 19 '15 at 17:17
  • Thanks a lot. So could you be more precise ("1 - check this on your server, 2 - check this from your client, 3 - etc.") and edit your question? I think it will help me and maybe some other people. Anyway +1 – rap-2-h Oct 19 '15 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.