LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 02-22-2006, 01:38 AM   #1
procfs
Member
 
Registered: Jan 2006
Location: Sri Lanka
Posts: 651

Rep: Reputation: 34
I can stay loged in get disconected


Hi

I am using Redhat ES3, and I try to login using ssh

ssh x.x.x.x
and passwd

I can login and give this message

Last login: Tue Feb 21 22:09:29 2006 from 10.1.2.24

gives me the prompt (loges me in)

but after few seconds get disconected giving this message

Read from remote host 10.1.2.38: Connection reset by peer
Connection to 10.1.2.38 closed.

and I try again in the same window I get this message.


@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
71:fd:3d:7e:e9:64:65:20:d5:c5:97:cc:b1:49:60:7c.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending key in /root/.ssh/known_hosts:5
RSA host key for 10.1.2.38 has changed and you have requested strict checking.
Host key verification failed.


Can any body tell me what is wrong with the machine and hoe to fix this problem


thank you

asanka
 
Old 02-22-2006, 01:48 AM   #2
randyding
Member
 
Registered: May 2004
Posts: 552

Rep: Reputation: 31
This just means your server's RSA key changed.
This can happen for a number of administrative reasons, but usually is harmless.
The way to get past this is to open your ~/.ssh/known_hosts file and delete the line for that server. When you ssh to that server again the line will be added back with the new key and it will work for you.
 
Old 02-22-2006, 02:04 PM   #3
int0x80
Member
 
Registered: Sep 2002
Posts: 310

Rep: Reputation: Disabled
There is something else going on if asanka is being logged out after a few seconds, and the host key is changing each time. Better do some forensics on the box. If you have physical access, you might want to disconnect it (the server) from the network and install chkrootkit, rkhunter, and clamav. If any of those come back with positives, you'll need to do better in securing your systems.
 
Old 02-23-2006, 12:28 AM   #4
procfs
Member
 
Registered: Jan 2006
Location: Sri Lanka
Posts: 651

Original Poster
Rep: Reputation: 34
Hay thaks guys
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
enable screensaver when loged as root mlu Linux - Software 1 06-15-2005 02:22 AM
Do this means someone have loged into my server? latino Linux - Security 3 03-06-2005 04:03 PM
Anybody loged on in ymessenger account with linspire 4.5 ?!? marius7sv Linux - Software 3 09-07-2004 01:41 AM
Hoto limit the number of minutes a user may be loged on in a day? Mandrake 9 tmillard Linux - Software 1 04-13-2004 08:04 PM
Knowing when a computer has been disconected krozinsky Linux - Networking 2 01-11-2004 03:36 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:41 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration