LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)
-   -   A problem with ssh connection (https://www.linuxquestions.org/questions/linux-software-2/a-problem-with-ssh-connection-642124/)

lawrence_lee_lee 05-14-2008 08:30 AM

A problem with ssh connection
 
I have a computer running Linux at my home. Of course, I am the administrator.

I often use ssh to connect to it when I am in my office everyday. No problems have arised for a very long time (about a year).

But today when I try to connect to my system, it gave me the following warning,
Quote:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
----------------------------------- (I hide my RSA fingerprint here.)
Please contact your system administrator.
Add correct host key in ~/.ssh/known_hosts to get rid of this message.
Offending key in ~/.ssh/known_hosts:21
RSA host key for [(my IP)]: (my port) has changed and you have requested strict checking.
Host key verification failed.
Since I myself is the system administrator, I definitely know that I did not change anything in my linux system running the sshd.

So, is there really such a possibility of me being attacked by a "man in the middle"? Are there any chances that my system change its RSA host key by itself? And what should I do now?

I need to connect to my system everyday. Please help!

TB0ne 05-14-2008 09:30 AM

If your office PC has changed (new NIC? IP Address?), or your network admin has changed the NAT'ted address of what's going to the outside world (i.e., the internet, back to your house), the SSH info is going to have changed. Network-related things, such as IP and MAC addresses, are going to relate to your SSH key. Anything changes, and it'll give you this message.

Go onto your linux box at home, and edit your $HOME/.ssh/known_hosts, and remove the IP address that's related to your work PC. You should be able to connect then. Of course, you SHOULD check your system, and make sure that no one else has logged in and done something....

lawrence_lee_lee 05-14-2008 09:49 PM

This morning, I also tried to connect to my linux system at home from my friend's home computer. And I got the same warning! I am very sure that I've succeeded to connect to my computer at my friend's home without this warning for not more than 2 weeks ago. So does this mean that the problen is not associated with my office network, but my home linux box instead? And what else I should check? I am worried about the "man-in-the-middle attack".

TB0ne 05-15-2008 01:01 PM

Quote:

Originally Posted by lawrence_lee_lee (Post 3153584)
This morning, I also tried to connect to my linux system at home from my friend's home computer. And I got the same warning! I am very sure that I've succeeded to connect to my computer at my friend's home without this warning for not more than 2 weeks ago. So does this mean that the problen is not associated with my office network, but my home linux box instead? And what else I should check? I am worried about the "man-in-the-middle attack".

Like I said, if ANYTHING changes from a network standpoint, you'll get this message. Did anything change on your Linux box? New DHCP address? Power failure at home lately, causing your router to come up with a different external IP?

lawrence_lee_lee 05-15-2008 11:45 PM

I don't know what DHCP address is. But for the external IP. That certainly remains unchanged.

By the way, how can I check out what you've said? What command to use?

TB0ne 05-16-2008 08:14 AM

Quote:

Originally Posted by lawrence_lee_lee (Post 3154842)
I don't know what DHCP address is. But for the external IP. That certainly remains unchanged.

By the way, how can I check out what you've said? What command to use?

If you've got a home network, your internal stuff probably is using DHCP. That means that when you power up a device, it'll go out and query the DHCP server (in this case, your home router), and get an address. Sometimes it'll get the same one...sometimes not. DHCP is Dynamic Host Configuration Protocol, with Dynamic being the operative word. If you assign static addresses, you can sidestep that issue, but have to know how to configure such things.

If you want to check addresses and such, look at the man page for ifconfig. In your case, I'd just suggest going on to your linux box, and removing the entries in the $HOME/.ssh/known_hosts file, and letting your external connections rebuild. You might also have to do that on your remote systems too, such as you work PC. Until you find out what caused your network changes, be prepared to do this again, next time something changes.


All times are GMT -5. The time now is 04:35 PM.