Got a warning message - remote authentication changed. Should I be worried?

Question

Last night I started getting the following warning on all of my servers when accessing github.com.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is ..... Please contact your system administrator. Add correct host key in /home/user/.ssh/known_hosts to get rid of this message.

There is an easy fix of course, https://stackoverflow.com/questions/20840012/ssh-remote-host-identification-has-changed, but I don't know why I get this message all of sudden.

I did not change .ssh/known_hosts.

Should I be worried? What steps should I take?

Thanks in advance,

Answer 1

See https://help.github.com/en/github/authenticating-to-github/testing-your-ssh-connection for the expected host fingerprint.

I used ssh -v -T [email protected] to see the host key my ssh client verified, and it was nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8 which is listed on their page, so the connection is not MiTM'd.

I don't know why it happened. I guess a change in your ssh client (or their ssh server) switched from using one host key to another, for example because the host key algorithm was deprecated.

EDIT 2023-03-24

Github had to update their RSA host key because they accidentally revealed it.

https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/

https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints