1

I have this following error when I tried to connect using SSH:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
14:44:d3:d7:ba:ba:6e:d2:a0:20:8f:9d:56:c6:d9:54.
Please contact your system administrator.
Add correct host key in /home/arinto/.ssh/known_hosts to get rid of this message.
Offending key in /home/arinto/.ssh/known_hosts:85
RSA host key for 10.0.109.37 has changed and you have requested strict checking.
Host key verification failed.

Interestingly, after few seconds, I can connect normally. Which means, the remote host identification revert back to the one that I have in my ~/.ssh/known_hosts.

What's the root cause of this behaviour?

Here's the detail of my system:

  • CentOS 6.7
  • uname -a output: Linux cat1.xxxx.xxx.xxx.xx 2.6.32-573.7.1.el6.x86_64 #1 SMP Tue Sep 22 22:00:00 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
  • Managed by Puppet 3.8.3 and Foreman
  • The server is a data node in our Elasticsearch cluster. The Puppet also manages the Elasticsearch cluster.

Update:

What I've done so far:

  • Examined \var\log\messages, but I did not find any suspicious message
  • Inspected all the log files in \var\log that recently updated, but I did not find any suspicious message
9
  • You may be connecting to the load balanced hostname or the virtual ip-address of the cluster. Rather than connecting directly to a specific node from that cluster you're connecting to alternating nodes. Does dig hostname correspond to the ip-address of your node?
    – HBruijn
    Apr 21, 2016 at 9:52
  • "The server is a data node in our Elasticsearch cluster." - you are ssh'ing to a virtual ip address managed by HAproxy probably - the MAC address is changing.
    – Sum1sAdmin
    Apr 21, 2016 at 11:03
  • @HBruijn: dig hostname correponds to my node. I did ssh using the ip address.
    – arinto
    Apr 22, 2016 at 0:53
  • @Rob-d: nope, there is no HAProxy in front of our Elasticsearch. Is it possible that internally, there's a process that changes the host key?
    – arinto
    Apr 22, 2016 at 0:53
  • Does your ssh problem happen when puppet is running? It may replace the host key file temporarily or something similar.
    – chicks
    Apr 22, 2016 at 2:23

0

You must log in to answer this question.

Browse other questions tagged .