I have this following error when I tried to connect using SSH:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
14:44:d3:d7:ba:ba:6e:d2:a0:20:8f:9d:56:c6:d9:54.
Please contact your system administrator.
Add correct host key in /home/arinto/.ssh/known_hosts to get rid of this message.
Offending key in /home/arinto/.ssh/known_hosts:85
RSA host key for 10.0.109.37 has changed and you have requested strict checking.
Host key verification failed.
Interestingly, after few seconds, I can connect normally. Which means, the remote host identification revert back to the one that I have in my ~/.ssh/known_hosts
.
What's the root cause of this behaviour?
Here's the detail of my system:
- CentOS 6.7
uname -a
output:Linux cat1.xxxx.xxx.xxx.xx 2.6.32-573.7.1.el6.x86_64 #1 SMP Tue Sep 22 22:00:00 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
- Managed by Puppet 3.8.3 and Foreman
- The server is a data node in our Elasticsearch cluster. The Puppet also manages the Elasticsearch cluster.
Update:
What I've done so far:
- Examined
\var\log\messages
, but I did not find any suspicious message - Inspected all the log files in
\var\log
that recently updated, but I did not find any suspicious message
dig hostname
correspond to the ip-address of your node?dig hostname
correponds to my node. I did ssh using the ip address.ssh
problem happen whenpuppet
is running? It may replace the host key file temporarily or something similar.