Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Why or why am I getting this error on server A trying to connect to server B?????

ssh root@zk.111.sf.development.cloudera.fu.com
Warning: the ECDSA host key for 'zk.111.sf.development.cloudera.fu.com' differs from the key for the IP address '107.170.xxx.xxx'
Offending key for IP in /root/.ssh/known_hosts:4
Matching host key in /root/.ssh/known_hosts:5
Are you sure you want to continue connecting (yes/no)? no
Host key verification failed.
enter code here

On server A I do this

eval `ssh-agent -s`
ssh-keyscan 107.170.xxx.xxx | tee -a /root/.ssh/known_hosts

Then I try and ssh. Wow..both servers event have the same pub and private keys. I am trying to set passwordless auth between servers.

share|improve this question

3 Answers 3

It appears that some of your hosts have changed IP's recently and you've connected to them after and before the IP changes.

I would recommend you to cleanup your known_hosts file in the lines 4 and 5 to get rid of this error message.

Another thing to consider is: if you only want Server A connecting to Server B you just need to drop the Server A Public Key (the contents of id_dsa.pub or id_rsa.pub) in /root/.ssh/authorized_keys of Server B.

If you do want bidirectional connection you should do the same procedure for Server B to A.

share|improve this answer
    
I want bi-directional. I DROP the /root/.ssh/authorized_keys on both servers? –  Tampa Apr 25 at 1:56
    
how do I drop the keys? –  Tampa Apr 25 at 2:08
    
Considering you have a RSA key, just take the contents of id_rsa.pub from Server A to authorized_keys in Server B. Do a scp in the file from A to B. Then: cat id_rsa.pub >> /root/.ssh/authorized_keys ; and vice-versa. –  Vinícius Ferrão Apr 25 at 2:31
    
Do I still use ssh-keyscan 107.170.xxx.xxx | tee -a /root/.ssh/known_hosts? Or remove? –  Tampa Apr 25 at 2:36
    
Remove lines four and five as I said from the known_hosts file. –  Vinícius Ferrão Apr 25 at 3:15

From ssh_config(5) man page,there is one PATTERNS

CheckHostIP

If this flag is set to "yes", ssh(1) will additionally check the host IP address in the known_hosts file. This allows ssh to detect if a host key changed due to DNS spoofing. If the option is set to "no", the check will not be executed. The default is "yes".

so,you can put CheckHostIP no in your /etc/ssh/ssh_config file.


as @Vinícius Ferrão say,it is not secure. best idea is put CheckHostIP no in your ~/.ssh/config file.here is a sample:

Host bar.local bar
    Hostname bar.local
    CheckHostIP no

you should do the same operation on A and B.i think it is a best idea with DHCP enabled network.

share|improve this answer
1  
It's never a good option to disable this! –  Vinícius Ferrão Apr 25 at 3:16
    
yes, you are right.you can Put CheckHostIP no in your ~/.ssh/config file is good idea.like this: <pre>Host zk.111.sf.development.cloudera.fu.com Hostname zk.111.sf.development.cloudera.fu.com CheckHostIP no</pre> –  7rack Apr 25 at 3:20

We fixed our similar issue by removing old entries on know_hosts files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.