2

Today, when I tried to login from my Linux laptop to a Linux server with SSH, I got the error message:

WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

As I did not change the machines keys I did an ssh -v to see what happens. I found that my OpenSSH client (SSH-2.0-OpenSSH_7.2p2) accepts the "host key algorithm: ecdsa-sha2-nistp256", while in my known_hosts there is a rsa-key for the corresponding server (which worked fine till today...).

The only thing that might have changed is the OpenSSH version.

How can I make OpenSSH ask for the RSA host key again?

P.S.: The Error Message and some preceding lines as requested:

debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:k/ADO4oeYIUNdsGBEkKXkggNP5pr3t9QlYSr8GOLSd1
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:k/ADO4oeYIUNdsGBEkKXkggNP5pr3t9QlYSr8GOLSd1.
Please contact your system administrator.
Add correct host key in /home/nn/.ssh/known_hosts to get rid of this message.
Offending RSA key in /home/nn/.ssh/known_hosts:51
  remove with:
  ssh-keygen -f "/home/nn/.ssh/known_hosts" -R server31
ECDSA host key for server31 has changed and you have requested strict checking.
Host key verification failed.
Improve this question
2
  • please, provide the whole error message, you got.
    – Jakuje
    Commented Sep 13, 2016 at 18:14
  • @Jakuje : Thanks, could not put the message into a comment... Please see my original post. When I use keyscan ( ssh-keyscan -t rsa server31 ) I can see that the rsa key equals the one in my known_hosts.
    – McSvenster
    Commented Sep 14, 2016 at 9:00

1 Answer 1

Reset to default
1

You can request a specific host key algorithm with HostKeyAlgorithms option. In CLI for RSA:

ssh -o HostKeyAlgorithms=ssh-rsa <server>

or in the ~/.ssh/config under the specific Host section:

HostKeyAlgorithms=ssh-rsa
Improve this answer
1
  • Thanks a lot, this shows, that my idea was wrong... With that I get an DNS-Spoofing warning: "WARNING: POSSIBLE DNS SPOOFING DETECTED! The RSA host key has changed, and the key for the corresponding IP address is unchanged" . Now I am totally lost. The IP address and the keys definitly did not change.
    – McSvenster
    Commented Sep 13, 2016 at 13:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .