Description

User receives error message warning that remote host identification has changed. This article offers several explanations and provides a procedure to correct the error.

Symptoms

You may get the following errors and fail with access by SSH from jump server:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
02:5b:98:c3:03:7d:9b:72:b6:61:53:dd:e5:8a:f3:4c.
Please contact your system administrator.
Add correct host key in /var/home/remote/.ssh/known_hosts to get rid of this message.
Offending key in /var/home/remote/.ssh/known_hosts:8
RSA host key for test1 has changed and you have requested strict checking.
Host key verification failed.

Solution

This may be caused by:

  • Either the client or server software has changed, and now they are negotiating SSHv2 whereas before they were negotiating SSHv1. [ref 6]
  • The machine has been re-installed with the same hostname, but the original keys were not restored. Since they've been created anew, they will of course not match your known_hosts file.
  • The machine to which you wish to connect has been moved to a different DNS name or IP address, or it's been replaced by a new one entirely.

Here is the solution:

  1. Find the file of /home/migrasi/.ssh/known_hosts on jump server
  2. Delete the RSA key of the remote hosts. Using test1 as an example, delete the following lines:
test1,10.10.10.10ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAsVv5tgjqSrpSPfojCKLbE+mq98B6GfjUbgI3ccVkZqsby9rkGXo3n5Dk0natw8RqkzXMaro
TvM5yTMGxinsxbVU/ReTZqniHNs0LATirnA5ySIpbmDILDPZf2ZUDGWxsi5RPekmLl6kN3cLrcvNe/K+y24DEMMUQXyusQPSqd/3z5K9bDSw1YdzVcr8/MmZwANla+aZlHdr
VNTqoMnizm26ytc8XUwTviHNvcdqJwihRz5N9idI+Rfoe9C26bNHHCaGmsTgOrCQc8h6S40FgPndGVs6stMNH6KzmVzB1ONdfixmLu+Y1yGYUqCsU9vIuE+yGvKRvLCKqd9z
UT2lwTw==

  • Re-establish the SSH connection from the jump server and accept the new RSA key.