Wednesday, September 29, 2010

Removing entries from the known_hosts

One often encounters the following error message, particularly in situations where the machine owning the target IP address has changed:

user@host-machine:~$ ssh user@target_IP
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
XX:XX:XX.
Please contact your system administrator.
Add correct host key in /home/user/.ssh/known_hosts to get rid of this message.
Offending key in /home/user/.ssh/known_hosts:4
RSA host key for target_IP has changed and you have requested strict checking.
Host key verification failed.


The issue can be resolved by using the ssh-keygen command with the -R option to remove and update the known_hosts file. Simply do:

user@host-machine:~$ ssh-keygen -R target_IP -f /home/user/.ssh/known_hosts
/home/user/.ssh/known_hosts updated.
Original contents retained as /home/user/.ssh/known_hosts.old
user@host-machine:~$ ssh user@target_IP
The authenticity of host 'target_IP (target_IP)' can't be established.
RSA key fingerprint is XX:XX:XX.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'target_IP' (RSA) to the list of known hosts.
user@target_IP's password:
Linux XenOpen 2.6.32.21-xen #2 SMP Mon Sep 27 10:23:06 EDT 2010 x86_64 GNU/Linux
Ubuntu 10.04.1 LTS