Removing the offending host key when a server updates should be easier

Bug #662068 reported by Scott Ritchie
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ubuntu Server papercuts
Fix Released
Undecided
Unassigned
openssh (Ubuntu)
Fix Released
Wishlist
Unassigned

Bug Description

If I have a server at a particular IP, and I have an ssh history with that, ssh will store the key in ~/.known-hosts. If I then replace that server, but use the same IP, the server will have a new fingerprint that will conflict with the one in ~/.known-hosts.

ssh will then, properly, complain about a key mismatch and warn about a possible man in the middle attack. This is good design, however if I'm expecting this error because I knowingly changed the server, it gets difficult to work around it.

This is the current sort of warning ssh spits out:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for foo.server.com has changed,
and the key for the corresponding IP address 12.34.56.78
is unknown. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
ab:cd:ef:de:ad:be:ef:12:34:56:78:90:de:ad:be:ef.
Please contact your system administrator.
Add correct host key in /home/scott/.ssh/known_hosts to get rid of this message.
Offending key in /home/scott/.ssh/known_hosts:15
RSA host key for wine.budgetdedicated.com has changed and you have requested strict checking.
Host key verification failed.

There are actually two warnings here. Regardless, there's no clear path forward -- editing ~/.known-hosts in a text editor (eg nano) isn't useful, because the IP entries are obscured. It's also very easy to miss the fact that the warning is actually telling you a line number ("Offending key in known_hosts:15") -- this should be an explicit message "Offending key in known_hosts on line 15". That would be a simple fix, but it still makes editing larger known_hosts files a pain (especially in nano, which doesn't have obvious line numbers)

This could be even easier if ssh had some sort of switch to handle this situation. A sort of "ssh --I-changed-the-server-key" or "ssh --forget-key" command. Some quick searching shows this to be a common problem, with multiple blog posts describing various ways to fix the situation (eg sed scripts to remove the particular line)

ProblemType: Bug
DistroRelease: Ubuntu 10.10
Package: ssh (not installed)
ProcVersionSignature: Ubuntu 2.6.35-22.34-generic 2.6.35.4
Uname: Linux 2.6.35-22-generic x86_64
NonfreeKernelModules: nvidia
Architecture: amd64
Date: Sun Oct 17 03:04:06 2010
InstallationMedia: Ubuntu 10.10 "Maverick Meerkat" - Beta amd64 (20100901.1)
ProcEnviron:
 LANG=en_US.utf8
 SHELL=/bin/bash
SourcePackage: openssh

description: updated
Mathias Gug (mathiaz)
Changed in openssh (Ubuntu):
importance: Undecided → Wishlist
Revision history for this message
Clint Byrum (clint-fewbar) wrote :

I have to agree that the way the error is printed is quite confusing.

Just replacing the '$file:$line' with '$file on line $line' would be a very simple usability improvement.

Marking Confirmed.

Changed in openssh (Ubuntu):
status: New → Confirmed
Revision history for this message
Sergey Svishchev (svs) wrote :

Isn't "ssh-keygen -R" the tool for this job?

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Scott, use "ssh-keygen -R foo.server.com".

Revision history for this message
Scott Ritchie (scottritchie) wrote :

Indeed it seems that's the right thing, but to be honest I'd never even seen the ssh-keygen command as I expected that sort of thing to be handled by ssh. So there's still a discoverability problem here. Perhaps the error message could mention ssh-keygen as well.

Revision history for this message
Clint Byrum (clint-fewbar) wrote :

Agreed Scott, I have been using OpenSSH for many many years, since the first port to Linux, and I never knew about this (pretty cool) way of removing old keys.

So in addition to adding the text "on line" to the error message, I would also agree that adding a line after that suggesting that the user can remove this old key after verification by running 'ssh-keygen -R $host' would be a great help to discoverability of this feature.

Revision history for this message
Andreas Olsson (andol) wrote :

As of openssh 1:5.6p1-2ubuntu3 (natty) at least the the ssh-keygen -R trick has been added.

andreas@stilgar:~$ ssh lucy
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
d1:1b:19:4c:2d:51:b0:18:e2:e4:c3:19:ad:9c:24:9d.
Please contact your system administrator.
Add correct host key in /home/andreas/.ssh/known_hosts to get rid of this message.
Offending RSA key in /home/andreas/.ssh/known_hosts:175
  remove with: ssh-keygen -f "/home/andreas/.ssh/known_hosts" -R lucy
RSA host key for lucy has changed and you have requested strict checking.
Host key verification failed.
andreas@stilgar:~$

Revision history for this message
Clint Byrum (clint-fewbar) wrote :

Nice, thanks Andreas for noticing that.

And thanks Colin Watson for the fix:

openssh (1:5.7p1-2ubuntu1) natty; urgency=low

  * Resynchronise with Debian experimental. Remaining changes:
    - Add support for registering ConsoleKit sessions on login.
    - Drop openssh-blacklist and openssh-blacklist-extra to Suggests.
    - Convert to Upstart. The init script is still here for the benefit of
      people running sshd in chroots.
    - Install apport hook.
    - Add mention of ssh-keygen in ssh connect warning.
    - Make openssh-server recommend ssh-import-id.

 -- Colin Watson <email address hidden> Thu, 27 Jan 2011 12:20:29 +0000

Marking Fix Released.

Changed in openssh (Ubuntu):
status: Confirmed → Fix Released
Changed in server-papercuts:
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.