LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 06-08-2020, 12:26 PM   #1
tuxthegreat
Member
 
Registered: Mar 2018
Distribution: Ubuntu Mate, OSX, Win10, ODROID-N2+
Posts: 176

Rep: Reputation: Disabled
Possibly being hacked


[CODE]ssh root@192.168.1.1 -p ######
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:Sa0f8v+L1FUvN0t0/cVPkuV6XIShgZirngrPhm53ias.
Please contact your system administrator.
Add correct host key in /Users/userr/.ssh/known_hosts to get rid of this message.
Offending RSA key in /Users/user/.ssh/known_hosts:3
RSA host key for [192.168.1.1]####### has changed and you have requested strict checking.
Host key verification failed.
raf:.ssh rafbancer$ nanao known_hosts
-bash: nanao: command not found
raf:.ssh user$ ls
id_ed25519 id_ed25519.pub id_rsa id_rsa.pub known_hosts
raf:.ssh user$ nano known_hosts[/CODE}

What I did was I reinstalled router ( Linksys WRT 3200 ACM ) firmware and wanted to add my ssh info and thats what the terminal spit out. What can I do? Please I will answer anything.
 
Old 06-08-2020, 12:30 PM   #2
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 26,636

Rep: Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965
Quote:
Originally Posted by tuxthegreat View Post
Code:
ssh root@192.168.1.1 -p ######
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:Sa0f8v+L1FUvN0t0/cVPkuV6XIShgZirngrPhm53ias.
Please contact your system administrator.
Add correct host key in /Users/userr/.ssh/known_hosts to get rid of this message.
Offending RSA key in /Users/user/.ssh/known_hosts:3
RSA host key for [192.168.1.1]####### has changed and you have requested strict checking.
Host key verification failed.
raf:.ssh rafbancer$ nanao known_hosts
-bash: nanao: command not found
raf:.ssh user$ ls
id_ed25519	id_ed25519.pub	id_rsa		id_rsa.pub	known_hosts
raf:.ssh user$ nano known_hosts
What I did was I reinstalled router ( Linksys WRT 3200 ACM ) firmware and wanted to add my ssh info and thats what the terminal spit out. What can I do? Please I will answer anything.
Remove the offending key from the known_hosts file on line 3, as the message said. You changed networking things, so IP addresses, etc., have changed, all of which figure into the SSH handshake. So, it's changed...and it's letting you know. Since you KNOW who made the change (you), remove the offending line, log in again, and it'll put an updated authorization line out there.
 
2 members found this post helpful.
Old 06-08-2020, 12:32 PM   #3
tuxthegreat
Member
 
Registered: Mar 2018
Distribution: Ubuntu Mate, OSX, Win10, ODROID-N2+
Posts: 176

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by TB0ne View Post
Remove the offending key from the known_hosts file on line 3, as the message said. You changed networking things, so IP addresses, etc., have changed, all of which figure into the SSH handshake. So, it's changed...and it's letting you know. Since you KNOW who made the change (you), remove the offending line, log in again, and it'll put an updated authorization line out there.
a
Thats exactly what I did, I k-lined the offending line, saved and logged in again to create a new known_hosts.
 
Old 06-09-2020, 02:06 AM   #4
ondoho
LQ Addict
 
Registered: Dec 2013
Posts: 19,872
Blog Entries: 12

Rep: Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053
Quote:
Originally Posted by tuxthegreat View Post
a
Thats exactly what I did, I k-lined the offending line, saved and logged in again to create a new known_hosts.
Good.
Please mark this SOLVED now (see my signature).
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
internet problems, possibly hacked - (thought it was child-block) catatom Linux - Security 7 10-19-2014 01:22 PM
[SOLVED] My network is hacked for sure. I want to reinstall but it will be hacked again. MsRefusenik Linux - Security 19 10-18-2010 05:02 PM
Being possibly dosd unixpirate Linux - Security 7 11-07-2002 01:39 PM
I think I'm being hacked. How to proceed? Noerr Linux - Security 25 05-31-2002 03:48 AM
help! ssh password being denied for ALL acccounts (hacked?) JustinHoMi Linux - Security 4 05-26-2002 05:57 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 02:42 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration