2

Why or why am I getting this error on server A trying to connect to server B?????

ssh root@zk.111.sf.development.cloudera.fu.com
Warning: the ECDSA host key for 'zk.111.sf.development.cloudera.fu.com' differs from the key for the IP address '107.170.xxx.xxx'
Offending key for IP in /root/.ssh/known_hosts:4
Matching host key in /root/.ssh/known_hosts:5
Are you sure you want to continue connecting (yes/no)? no
Host key verification failed.
enter code here

On server A I do this

eval `ssh-agent -s`
ssh-keyscan 107.170.xxx.xxx | tee -a /root/.ssh/known_hosts

Then I try and ssh. Wow..both servers event have the same pub and private keys. I am trying to set passwordless auth between servers.

1
  • 1
    The servers shouldn't both have the same private key. Sep 9 '15 at 0:24
4

It appears that some of your hosts have changed IP's recently and you've connected to them after and before the IP changes.

I would recommend you to cleanup your known_hosts file in the lines 4 and 5 to get rid of this error message.

Another thing to consider is: if you only want Server A connecting to Server B you just need to drop the Server A Public Key (the contents of id_dsa.pub or id_rsa.pub) in /root/.ssh/authorized_keys of Server B.

If you do want bidirectional connection you should do the same procedure for Server B to A.

5
  • I want bi-directional. I DROP the /root/.ssh/authorized_keys on both servers?
    – Tampa
    Apr 25 '14 at 1:56
  • how do I drop the keys?
    – Tampa
    Apr 25 '14 at 2:08
  • Considering you have a RSA key, just take the contents of id_rsa.pub from Server A to authorized_keys in Server B. Do a scp in the file from A to B. Then: cat id_rsa.pub >> /root/.ssh/authorized_keys ; and vice-versa. Apr 25 '14 at 2:31
  • Do I still use ssh-keyscan 107.170.xxx.xxx | tee -a /root/.ssh/known_hosts? Or remove?
    – Tampa
    Apr 25 '14 at 2:36
  • Remove lines four and five as I said from the known_hosts file. Apr 25 '14 at 3:15
4

From ssh_config(5) man page,there is one PATTERNS

CheckHostIP

If this flag is set to "yes", ssh(1) will additionally check the host IP address in the known_hosts file. This allows ssh to detect if a host key changed due to DNS spoofing. If the option is set to "no", the check will not be executed. The default is "yes".

so,you can put CheckHostIP no in your /etc/ssh/ssh_config file.


as @Vinícius Ferrão say,it is not secure. best idea is put CheckHostIP no in your ~/.ssh/config file.here is a sample:

Host bar.local bar
    Hostname bar.local
    CheckHostIP no

you should do the same operation on A and B.i think it is a best idea with DHCP enabled network.

2
  • 1
    It's never a good option to disable this! Apr 25 '14 at 3:16
  • yes, you are right.you can Put CheckHostIP no in your ~/.ssh/config file is good idea.like this: <pre>Host zk.111.sf.development.cloudera.fu.com Hostname zk.111.sf.development.cloudera.fu.com CheckHostIP no</pre>
    – 7rack
    Apr 25 '14 at 3:20
1

Problem

This problem is caused by using the same public/private keypair on two different servers. Each server needs a unique public/private keypair.

Background

The fingerprint of each server you SSH to will get recorded in ~/.ssh/known_hosts so you can avoid a MITM attack when you connect to any server you have previously connected to. When you connect to two different servers which each have the same public key, or a server which has a different public key than the one in your ~/.ssh/known_hosts file, SSH warns that something is wrong and won't let you connect (by default). There is no need to disable this security warning.

Solution

  1. Generate a new public/private keypair for at least one of the two servers. If you're only going to regenerate one, choose the pair which was copied across the network. The exact method will depend on your operating system, but if you're on linux the command will probably be something like this:

    sudo ssh-keygen -f /etc/ssh/ssh_host_rsa_key -N '' -t rsa
    sudo ssh-keygen -f /etc/ssh/ssh_host_dsa_key -N '' -t dsa
    
  2. You'll need to remove the outdated fingerprints from your ~/.ssh/known_hosts files everywhere they exist. Please don't just delete all your ~/.ssh/known_hosts files. That's the easy way out but it leaves you vulnerable to a MITM attack. The file is easy to read. Each line represents a single host. Find the two which have the ip address(es) of your servers and delete them.

Moving ahead

You mention that you're trying to set up password-less authentication between servers, so you'll need to generate a public/private keypairs for the users which will connect to another server.

  1. In the terminal on one of the servers, switch to the user account which will be initiating this connection. This probably shouldn't be root, but that's up to you. You can do this with su - user where user is the username you are switching to.

  2. Now generate a keypair with ssh-keygen -t rsa. Do not assign a password, or you will have to enter it every time you use it which defeats the whole point of what you're doing. You can also customize the command if you want and know what you're doing. This step will take a little while and it will print out a line art of the public key in the process. I don't know what happens if a key has already been generated, so there's a chance it might give an error. No worries. Just continue to the next step.

  3. Copy this user's public key to the user account on the other server. There is a command for that, which is ssh-copy-id user@host. You will need to use the password of the remote account or the copy will not go through.

  4. Immediately test that the key installed correctly by doing ssh user@host. Now the user can login as the remote user of the other server without a password. If this worked, repeat the process with the servers swapped.

0

For me after editing and editing .ssh/known_hosts over and over, it turned out simply removing the "ssh." finally fixed it:

$ ssh ssh.jidanni.org echo Hi
Warning: the ECDSA host key for 'ssh.jidanni.org' differs from the key for the IP address '64.90.44.253'
Offending key for IP in /home/jidanni/.ssh/known_hosts:32
Matching host key in /home/jidanni/.ssh/known_hosts:29
Hi
$ ssh jidanni.org echo Hi
Hi
-1

I had this exact same issue with

.ssh/known_hosts:4 .ssh/known_hosts:5

I deleted all the text out of the known_hosts file, saved, and reopened a new terminal session ssh'ing in and my issue was fixed.

0
-2

We fixed our similar issue by removing old entries on know_hosts files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.