2

Today, when I tried to login from my Linux laptop to a Linux server with SSH, I got the error message:

WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

As I did not change the machines keys I did an ssh -v to see what happens. I found that my OpenSSH client (SSH-2.0-OpenSSH_7.2p2) accepts the "host key algorithm: ecdsa-sha2-nistp256", while in my known_hosts there is a rsa-key for the corresponding server (which worked fine till today...).

The only thing that might have changed is the OpenSSH version.

How can I make OpenSSH ask for the RSA host key again?

P.S.: The Error Message and some preceding lines as requested:

debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ecdsa-sha2-nistp256 SHA256:k/ADO4oeYIUNdsGBEkKXkggNP5pr3t9QlYSr8GOLSd1 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the ECDSA key sent by the remote host is SHA256:k/ADO4oeYIUNdsGBEkKXkggNP5pr3t9QlYSr8GOLSd1. Please contact your system administrator. Add correct host key in /home/nn/.ssh/known_hosts to get rid of this message. Offending RSA key in /home/nn/.ssh/known_hosts:51 remove with: ssh-keygen -f "/home/nn/.ssh/known_hosts" -R server31 ECDSA host key for server31 has changed and you have requested strict checking. Host key verification failed.
Improve this question
2
  • please, provide the whole error message, you got. Commented Sep 13, 2016 at 18:14
  • @Jakuje : Thanks, could not put the message into a comment... Please see my original post. When I use keyscan ( ssh-keyscan -t rsa server31 ) I can see that the rsa key equals the one in my known_hosts. Commented Sep 14, 2016 at 9:00

1 Answer 1

Reset to default
1

You can request a specific host key algorithm with HostKeyAlgorithms option. In CLI for RSA:

ssh -o HostKeyAlgorithms=ssh-rsa <server>

or in the ~/.ssh/config under the specific Host section:

HostKeyAlgorithms=ssh-rsa
Improve this answer
1
  • Thanks a lot, this shows, that my idea was wrong... With that I get an DNS-Spoofing warning: "WARNING: POSSIBLE DNS SPOOFING DETECTED! The RSA host key has changed, and the key for the corresponding IP address is unchanged" . Now I am totally lost. The IP address and the keys definitly did not change. Commented Sep 13, 2016 at 13:33

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.