LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 04-19-2010, 08:00 AM   #1
bala150985
Member
 
Registered: May 2009
Location: Chennai, India
Distribution: Ubuntu
Posts: 39

Rep: Reputation: 15
Question SSH Putty "Server's host key did not match the signature supplied"


I have a SSH server "SSH-2.0-OpenSSH_5.1p1 Debian-6ubuntu2" running at IP 1.1.1.1

When I try to access it from another machine on the internet which is at 2.2.2.2 every thing goes fine. However when I try to do the same thing from 3.3.3.3 it does not work and Putty throws me this error "Server's host key did not match the signature supplied".

I went inside HKEY_Current_user\Software\SimonTatham\Putty\SshHostKeys and tried to remove all the known host and still the issue is existing, I am literally scratching my head as to what is going wrong.

I Googled about this error and I saw many were having problem similar to mine however none were able to give some conclusive results so far.

have a look at the network diagram.
Attached Images
File Type: jpg SSH problem.JPG (56.2 KB, 13 views)
 
Old 04-19-2010, 08:49 AM   #2
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 248Reputation: 248Reputation: 248
Have you tried running putty -cleanup from a command line ?
 
Old 04-19-2010, 09:11 AM   #3
bala150985
Member
 
Registered: May 2009
Location: Chennai, India
Distribution: Ubuntu
Posts: 39

Original Poster
Rep: Reputation: 15
I did that command and it nucked all the other entried I had on my Putty, that is not a problem I can build them back up, However still I am faced with the same problem
 
Old 04-19-2010, 09:46 AM   #4
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 248Reputation: 248Reputation: 248
Sorry, you didn't mention that you had other entries. The idea was to clear all the crud out of the registry.

If that has been done and the error persists, then it's hard to say really. Unless something really has changed on the server.

Has it ever worked from this machine ?
Can you ssh to other machines ok ?

BTW, you don't need -p when you are ssh-ing to a standard ssh port.

Can you check what the host key is on the other machine and compare it to what is on the problem machine ?

Are you using password based login or key based ?

Last edited by smoker; 04-19-2010 at 09:47 AM.
 
Old 04-19-2010, 10:22 AM   #5
bala150985
Member
 
Registered: May 2009
Location: Chennai, India
Distribution: Ubuntu
Posts: 39

Original Poster
Rep: Reputation: 15
I don't mind about the other entries which got erased.

I have changed nothing on my server.

It had never worked from the IP 3.3.3.3 to 1.1.1.1

Currently I don't have access to 2.2.2.2 to test and see if it is working correctly, I will do that and post soon.

My SSH server is listening on Port number 21 so I have to use -p option if not Connection will be refused.

I had even tried exporting the Reg key from the working machine to the machine which does not work, and yet it is giving the same result.
 
Old 04-20-2010, 12:41 AM   #6
bala150985
Member
 
Registered: May 2009
Location: Chennai, India
Distribution: Ubuntu
Posts: 39

Original Poster
Rep: Reputation: 15
I tried again to SSH from 2.2.2.2 to 1.1.1.1 and it works like a Charm.

I use password based login. I don't know how to make passwordless login using Putty, I know to do that between two Linux boxes.
 
Old 04-20-2010, 03:12 AM   #7
bala150985
Member
 
Registered: May 2009
Location: Chennai, India
Distribution: Ubuntu
Posts: 39

Original Poster
Rep: Reputation: 15
I got a linux box installed in the same subnet of 2.2.2.0 and tried ssh to my 1.1.1.1 box with Debug turned on still trouble.

[Linux@localhost .ssh]$ ssh -vvv bala@1.1.1.1 -p 21
OpenSSH_4.5p1, OpenSSL 0.9.8g 19 Oct 2007
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 1.1.1.1 [1.1.1.1] port 21.
debug1: Connection established.
debug1: identity file /home/smxmgr/.ssh/id_rsa type -1
debug1: identity file /home/smxmgr/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.1p1 Debian-6ubuntu2
debug1: match: OpenSSH_5.1p1 Debian-6ubuntu2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.5
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_init: found hmac-md5
debug1: kex: server->client aes128-cbc hmac-md5 none
debug2: mac_init: found hmac-md5
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 136/256
debug2: bits set: 504/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: put_host_port: [1.1.1.1]:21
debug3: put_host_port: [1.1.1.1]:21
debug3: check_host_in_hostfile: filename /home/smxmgr/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /etc/ssh/ssh_known_hosts
debug3: check_host_in_hostfile: filename /home/smxmgr/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /etc/ssh/ssh_known_hosts
debug1: checking without port identifier
debug3: check_host_in_hostfile: filename /home/smxmgr/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /etc/ssh/ssh_known_hosts
debug3: check_host_in_hostfile: filename /home/smxmgr/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /etc/ssh/ssh_known_hosts
debug2: no key of type 0 for host [1.1.1.1]:21
debug3: check_host_in_hostfile: filename /home/smxmgr/.ssh/known_hosts2
debug3: check_host_in_hostfile: filename /etc/ssh/ssh_known_hosts2
debug3: check_host_in_hostfile: filename /home/smxmgr/.ssh/known_hosts
debug3: check_host_in_hostfile: filename /etc/ssh/ssh_known_hosts
debug2: no key of type 2 for host [1.1.1.1]:21
The authenticity of host '[1.1.1.1]:21 ([1.1.1.1]:21)' can't be established.
RSA key fingerprint is 0d:f1:e5:3a:c7:3f:35:8a:f7:69:05:96:68:d1:e3:16.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[1.1.1.1]:21' (RSA) to the list of known hosts.
debug2: bits set: 504/1024
RSA_public_decrypt failed: error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01
debug1: ssh_rsa_verify: signature incorrect
key_verify failed for server_host_key

[Linux@localhost .ssh]$
 
Old 04-20-2010, 05:28 AM   #8
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 248Reputation: 248Reputation: 248
EDIT

When you open putty can you go to the section in the setup category that says Bugs
and change anything with SSH2 in the description to ON, instead of auto.

Then try connecting again.
#######################################

otherwise -

Have you got physical access to the server 1.1.1.1 ?

If so can you verify the ssh server version :

Code:
ssh -v
It appears that this is a bug where the server is encrypting it's host key incorrectly and so the client can't decrypt it.

From what I've read, you could just keep on trying until it works, or you could try creating a new host key on the ssh server, as root :
Code:
rm -f /etc/ssh/ssh_host_dsa_key
rm -f /etc/ssh/ssh_host_rsa_key
ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key
ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key
and clearing known hosts on the clients before connecting.

Last edited by smoker; 04-20-2010 at 05:38 AM.
 
Old 04-20-2010, 05:54 AM   #9
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 248Reputation: 248Reputation: 248
I also suggest setting the default port on the server (22) and then trying to connect with that. If only for a test.
 
Old 04-20-2010, 11:53 AM   #10
bala150985
Member
 
Registered: May 2009
Location: Chennai, India
Distribution: Ubuntu
Posts: 39

Original Poster
Rep: Reputation: 15
When you open putty can you go to the section in the setup category that says Bugs and change anything with SSH2 in the description to ON, instead of auto.

Then try connecting again.

I tried your point above it is not working.

Coming to the point of SSH key regenarationm, before going into it I am 100% sure that if I SSH from 2.2.2.2 to 1.1.1.1 it works like charm, but when 3.3.3.3 tries to access 1.1.1.1 it fails.


I will soon post the SSH -v option from 1.1.1.1 box.
 
Old 04-20-2010, 11:54 AM   #11
bala150985
Member
 
Registered: May 2009
Location: Chennai, India
Distribution: Ubuntu
Posts: 39

Original Poster
Rep: Reputation: 15
SSH-2.0-OpenSSH_5.1p1 Debian-6ubuntu2
 
Old 04-21-2010, 01:01 AM   #12
bala150985
Member
 
Registered: May 2009
Location: Chennai, India
Distribution: Ubuntu
Posts: 39

Original Poster
Rep: Reputation: 15
bala@ubuntu:~$ ssh -v
OpenSSH_5.1p1 Debian-6ubuntu2, OpenSSL 0.9.8g 19 Oct 2007
usage: ssh [-1246AaCfgKkMNnqsTtVvXxY] [-b bind_address] [-c cipher_spec]
[-D [bind_address:]port] [-e escape_char] [-F configfile]
[-i identity_file] [-L [bind_address:]port:host:hostport]
[-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]
[-R [bind_address:]port:host:hostport] [-S ctl_path]
[-w local_tun[:remote_tun]] [user@]hostname [command]
bala@ubuntu:~$
 
Old 04-21-2010, 01:03 AM   #13
bala150985
Member
 
Registered: May 2009
Location: Chennai, India
Distribution: Ubuntu
Posts: 39

Original Poster
Rep: Reputation: 15
I also suggest setting the default port on the server (22) and then trying to connect with that. If only for a test.

For this I firstly edited the sshd_config file and then restart the SSH daemon. Netstat -ant showed that SSH was listening on port 22 and I was able to locally SSH to my self. But when I tried to do over the to connect over to port 22 from 3.3.3.3 to 1.1.1.1 I don't get "Connection timed out" :-(

Last edited by bala150985; 04-21-2010 at 01:05 AM.
 
Old 04-21-2010, 06:47 AM   #14
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 248Reputation: 248Reputation: 248
If you are trying to connect from outside the local network then your router will need to forward the correct port.
 
Old 04-22-2010, 12:46 AM   #15
bala150985
Member
 
Registered: May 2009
Location: Chennai, India
Distribution: Ubuntu
Posts: 39

Original Poster
Rep: Reputation: 15
Well you are absolutely correct Smoker, however the 2.2.2.2 ---> 1.1.1.1 connection is working perfectly fine and 2.2.2.2 is out on the internet. My 1.1.1.1 IP is directly bound to my system eth0 card, I don't have a ADSL router sitting between my system and the internet.

I should really appreciate you trying to help me

However my issue is still not solved, I am literally banging my head to get this thing to work.
 
  


Reply

Tags
host, key, match, ssh


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Different SSH "Server unexpectedly closed network connection" (using Putty) mjwraw Linux - Networking 4 07-22-2009 08:23 AM
WinSCP FTP client connection to AIX gives "host key not found" warning. mufy AIX 2 06-17-2009 01:00 PM
"V3 DSA signature: BAD, Key" error while installing kernel2.6.2-8.i386.rpm MUsmanM Linux From Scratch 1 03-24-2009 09:32 AM
A single regex to match anything with ".aac" or ".mp3" at the end ? lumix Linux - General 9 05-09-2008 02:11 AM
SSH PuTTy gives "connection refused" Sathington Linux - Networking 5 03-18-2004 06:10 AM


All times are GMT -5. The time now is 07:33 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration