2

Today I went to connect t my Centos 7 box via ssh and my sftp client and both indicated that the server RSA key finger print had changed.

enter image description here

I've checked all my logs for suspicious activity but don't see anything out of the ordinary.

Is there a logical explanation that could account for this change?

  • What platform is the server running on? Physical? Virtual? What specific warning are they providing? That the fingerprint doesn't exist? Have you recently re-installed SFTP/SSH clients? – Mike B Feb 5 '15 at 20:49
  • It is a VM, it is not an error, just a notice that the key is not cached. The only time I get this message is connecting to new hosts. I have done nothing to change anything on the server regarding ssh or my clients. – sr_1436048 Feb 5 '15 at 20:51
  • Hmm.. Strange. So either 1) The key really is different... or 2) your clients forgot about it. Do you see the key referenced at all under HKEY_CURRENT_USER\SoftWare\SimonTatham\PuTTY\SshHostKey? – Mike B Feb 5 '15 at 21:01
  • The key is really different, I have 3 computers I use and they have all displayed the same message. The purpose of my question is to see if there is an innocent explanation or that I should continue looking for passable hack.. – sr_1436048 Feb 5 '15 at 21:03
  • I'll humbly defer to the gurus here for that. In the meantime, I'd suggest checking the "date modified" attribute for the public key file to see when it was recently updated. What logs have you checked? /var/log/messages? /var/log/secure? history? – Mike B Feb 5 '15 at 21:06
2

openssh client uses user given name to authenticate a server against the known_hosts file. the name can be letters or ip address.
In the former case, it's matched against Host entry in ssh_config and if the Host entry has HostName set it's used to check against known_hosts file. If the matched Host entry has no HostName set, the user supplied letters on the cli are checked against known_hosts file.

In the latter case, ip adress is checked. So a single host may have multiple entries each matching user supplied 'string of chars'. It happens because user can connect by ip, fqdn, a host entry in ssh_config file or just a dns prefix. When users refer to the same machine different way, the warning usually appears.
The above warning says the host is unknown. It means the client has'nt connected to this host before with this name or the client has connected to this host before with this name but the 'host key' of the host was not cached or cached and the cached key was removed meantime or cache has been corrupted or removed.
If you have connected to this host with example.com and cached the server host key earlier, the next time you connect to the host with example.com and if the server key is different from the cached one, the client would scream like remote host identification has changed, possible monkey-in-the-middle-attack.
openssh servers use four types of keys rsa, dsa, ecdsa and ed25519. It means the client must cache all the keys it's comfortable with.
Server keys fingerprint database must be built to cope with situation like this one. ssh-keygen -lf ssh_host_rsa_key.pub >> $HOME/example.com_host_key.txt for each key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.