How to remove strict RSA key checking in SSH and what's the problem here?

Question

I have a Linux server that whenever I connect it shows me the message that changed the SSH host key:

$ ssh root@host1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed. The fingerprint for the RSA key sent by the remote host is 93:a2:1b:1c:5f:3e:68:47:bf:79:56:52:f0:ec:03:6b. Please contact your system administrator. Add correct host key in /home/emerson/.ssh/known_hosts to get rid of this message. Offending key in /home/emerson/.ssh/known_hosts:377

RSA host key for host1 has changed and you have requested strict checking. Host key verification failed.

It keeps me for a very few seconds logged in and then it closes the connection.

host1:~/.ssh # Read from remote host host1: Connection reset by peer Connection to host1 closed.

Does anyone know what's happening and what I could do to solve this problem?

Answer 1

Please don't delete the entire known_hosts file as recommended by some people, this totally voids the point of the warning. It's a security feature to warn you that a man in the middle attack may have happened.

I suggest you identify why it thinks something has changed, most likely an SSH upgrade altered the encryption keys due to a possible security hole. You can then purge that specific line from your known_hosts file:

sed -i "377 d" ~/.known_hosts

This says remove line 377 as shown after the colon in the warning:

/home/emerson/.ssh/known_hosts:377

Alternatively you can remove the relevant key by doing the following

ssh-keygen -R 127.0.0.1 (Obviously replace with the servers IP)

Please DO NOT purge the entire file and ensure this is actually the machine you want to be connecting to prior to purging the specific key.

Answer 2

First of all, is this your machine ? Did you knowingly change the host keys ? If not I would be very concerned that something has altered that data.

Secondly, turn up the ssh debuging,

ssh -vvv user@host

and see what that tells you, also try looking in, /var/log/secure and /var/log/messages on the server you are trying to connect to for clues, sshd gives good error messages.

Thirdly, is this machine connected to the internet ? Should you really be allowing root logins ?

Answer 3

You are getting this because something has changed (like new NIC, new IP, change on server software, etc). Security focus has a nice article on SSH host key protection.

Just remove the key (using SFTP or similar) from the server, by editing the $HOME/.ssh/known_hosts file, and accept the new one upon next connection.

Your connection might be getting dropped because of the StrictHostKeyChecking setting. See this thread for a similar issue.