I reinstalled one of my machines and gave it new ssh keys, which should yield warnings when I connect to it from a machine I have connected from earlier.
First I get the big warning that the remote host identifcation has changed, it shows me the correct new ED25519 fingerprint, tells me the line number of the offending key in ~/.ssh/known_hosts and how to remove it with ssh-keygen.
I remove the cached key and connect again. This time it warns about the key for the IP address, which is also expected.
I type "yes" in response to the question if I'm sure I want to continue connecting, and then I use keyboard-interactive/password authentication, having just remotely created the account and set a password on it.
So, what happens after I type the password and hit enter?
I get the same warnings again, but only slightly messed up with a staircase effect like on old printers, where LF only advanced the paper one row and CR was needed to go to the first column.
Kind of what could happen when messing with the terminal settings when reading a password from a shell script.
This is what it looks like (Notice the proper line breaks and the visible
yes prior to password entry) :
Am I using a trojaned ssh? I'm on ubuntu 14.04.2 LTS according to /etc/issue, and the md5sum of the ssh binary is 429980edd6458dff7b113f5f1e162d10 and it is 641664 bytes. Googling for the hash doesn't make me any more enthusiastic.
What should I do now, apart from changing all my passwords everywhere?
Why is it asking me again if I'm sure I want to continue, after supplying a valid password?