Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I try to ssh to my server in Germany from my UK laptop I get:

Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.

I removed the appropriate line from my ~/.ssh/known_hosts and then ssh'ed once again. On the server (via ssh terminal) I execute:

ssh-keygen -lf /etc/ssh/

then from my laptop I do:

ssh-keyscan -p 22 -t rsa > /tmp/
ssh-keygen -l -f /tmp/

When I copare the results i see that the fingerprints are different! The length of the certificate is also different (on the server it is 2048 but remote scan shows 1024). The DSA fingerprints are also different.

The problem lies probably not in my local network, since arping for the server ip returns 0 results. I asked a friend in Poland to execute the same commands for me and he got the same results.

Any ideas on what is happening?

EDIT: When I ssh to the server and do:

ssh-keyscan -p 22 -t rsa > /tmp/
ssh-keygen -l -f /tmp/

then I see that the fingerprint is still different! Then when I do on the server:

argping -c 5 server_ip

I get 0 responses.

This is very weird!


username@server:~$ ssh-keyscan -p 22 > /tmp/rsa.tmp
# SSH-1.99-OpenSSH_33.33
username@server:~$ ssh-keygen -lf /tmp/rsa.tmp 
1024 12:................................. (RSA)
username@server:~$ ssh-keygen -lf /etc/ssh/ 
2048 32:................................. /etc/ssh/ (RSA)
share|improve this question

The cached key change can be explained by several reasons:

  1. You were really attacked by someone who is sitting between you and your server and intercepting your sessions.
  2. Your server IP is mapped to several real servers and you are recent switched to another machine. This can happen when you SSH to a VIP that can be switched between two servers.
  3. Your server system has been re-installed recently which changed the SSH key.

You should be able to determine whether this is normal or not.

share|improve this answer
Thanks Khaled for the quick reply! How do I diagnose nr 1? There seems to be no evidence of that because when I ssh-keyscan I still get the wrong fingerprint. As for the ip change, how do I check that? There is at least 3 domain providers that have my ip address so if my server ip has changed I would have to update DNS records with those providers. But my domains still work. Point 3 seems to be out of question since I sshd to the server and checked the ssh-keygen -lf /etc/ssh/ and it is different to what the ssh-keyscan shows. Thanks! :) – Wojtek B. Jan 30 '12 at 13:43
Do you have exactly one server machine mapped to exactly one IP? Did you upgrade/re-install the SSH service which may cause key change? – Khaled Jan 30 '12 at 14:06
Well, when on server I do arping -c 5 the_ip_addres I get 0 responses. Other thing is that as I mentioned when I skip the fingerprint check I connect to the right machine. – Wojtek B. Jan 30 '12 at 14:38
up vote 1 down vote accepted

The problem was that somebody attacked my server with an exploit on one or more of the services that it runs. The solution was to reinstall the whole system unfortunately (I was afraid that somebody might have left some backdoors).

I also followed the linux security tips this time.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.