2

Today, when I tried to login from my Linux laptop to a Linux server with SSH, I got the error message:

WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

As I did not change the machines keys I did an ssh -v to see what happens. I found that my OpenSSH client (SSH-2.0-OpenSSH_7.2p2) accepts the "host key algorithm: ecdsa-sha2-nistp256", while in my known_hosts there is a rsa-key for the corresponding server (which worked fine till today...).

The only thing that might have changed is the OpenSSH version.

How can I make OpenSSH ask for the RSA host key again?

P.S.: The Error Message and some preceding lines as requested:

debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:k/ADO4oeYIUNdsGBEkKXkggNP5pr3t9QlYSr8GOLSd1
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:k/ADO4oeYIUNdsGBEkKXkggNP5pr3t9QlYSr8GOLSd1.
Please contact your system administrator.
Add correct host key in /home/nn/.ssh/known_hosts to get rid of this message.
Offending RSA key in /home/nn/.ssh/known_hosts:51
  remove with:
  ssh-keygen -f "/home/nn/.ssh/known_hosts" -R server31
ECDSA host key for server31 has changed and you have requested strict checking.
Host key verification failed.
  • @techraf: Thanks for the helpful editig! – McSvenster Sep 13 '16 at 13:52
  • please, provide the whole error message, you got. – Jakuje Sep 13 '16 at 18:14
  • @Jakuje : Thanks, could not put the message into a comment... Please see my original post. When I use keyscan ( ssh-keyscan -t rsa server31 ) I can see that the rsa key equals the one in my known_hosts. – McSvenster Sep 14 '16 at 9:00
1

You can request a specific host key algorithm with HostKeyAlgorithms option. In CLI for RSA:

ssh -o HostKeyAlgorithms=ssh-rsa <server>

or in the ~/.ssh/config under the specific Host section:

HostKeyAlgorithms=ssh-rsa
  • Thanks a lot, this shows, that my idea was wrong... With that I get an DNS-Spoofing warning: "WARNING: POSSIBLE DNS SPOOFING DETECTED! The RSA host key has changed, and the key for the corresponding IP address is unchanged" . Now I am totally lost. The IP address and the keys definitly did not change. – McSvenster Sep 13 '16 at 13:33

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.