Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently, when connecting to a remote machine via SSH, I'm not able to get a stable SSH connection. It was working OK before, then the system got updated and its not stable anymore. (I connect to dozens of SSH systems daily, and admin some of them. But this one I really dont understand the behavior.)

At each connection tentative I get either: * WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! (RSA key changed) * If I accept the rsa change, I can connect... for a few seconds only ... and then, the RSA key is not valid any more.

So, yes... my first thought would be "oh my god, hackers"... but I hope there is another answer. Maybe there is some kind of proxy or weird routing going on? This is a remote datacenter in europe. I have the same problem no matter the machine I try to connect from.

share|improve this question
    
A bit of clarification: * I'm connecting to a IP (no hostname) * The key displayed change, it seems to oscillate between two values. And one of them is good (can connect) So... um, maybe the routing oscillate between two IP addresses, and when the routing changes, trying to reconnect will lead to the wrong machine! –  Blklight Jul 24 '09 at 13:14
    
So yeah, unless its a really tricky hacker, seems to be two machines on the same IP address, and I cannot trust the stability of the route up to the machine. I dont know how to investigate this, but at least i'm less worried :) –  Blklight Jul 24 '09 at 13:22

5 Answers 5

up vote 1 down vote accepted

Things to check:

  • Do trust the route between your client and server?
  • Are you always using the same hostname?
  • Is the hostname fully qualified?
  • Does the hostname always resolve to the same IP address?
  • Does the ID fluctuate between two RSA pubkeys?
  • Is there another machine on the same network as the server that you can use to confirm the ARP entry for the target machine remains the same?
share|improve this answer
    
Connection by IP. And yes, seems to be fluctuation between two RSA keys. –  Blklight Jul 24 '09 at 13:15
    
In that case, assuming there is no other load balancing involved, it could either be two machines fighting for the same IP or a messy MITM attempt. Both would be a cause for concern. –  Dan Carley Jul 24 '09 at 13:45

Does the key displayed in the warning change? If not, and you say the machine has been upgraded, then perhaps you just need to delete the old key and re-accept the new one (Usually the warning message displays the local key and line number is known_hosts)

share|improve this answer

Are you sure you are connecting to a single host on the remote side, it could be a round robin with different hosts keys on each host ?

I would be worried myself.

Does the DNS resolve to the correct host ?

Just temporarily move your known hosts out of the way and the try ssh -vvv to the host a couple of times there should be a clue in the log.

share|improve this answer

It sounds like there might be an IP address collision. Some times you get the machine you want, and others you get the other, which results in the key warnings.

share|improve this answer

You mentioned that the system got updated. Maybe the SSH keys got re-generated in the process (for example if the system was clean installed). This may be something to consider also, in addition to the other things mentioned.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.