SSH Host Key Change and MITM Warning

存档预览:Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also pos…(全文以下方原始文本完整保留)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ED25519 key sent by the remote host is
SHA256:1BgJjkyV
Please contact your system administrator.
Add correct host key in C:\\Users\\cczfk/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in C:\\Users\\cczfk/.ssh/known_hosts:6
Host key for 43.156.203.160 has changed and you have requested strict checking.
Host key verification failed.
This warning indicates that the SSH host key for the remote server (43.156.203.160) has changed, and your system is rejecting the connection because it suspects a potential man-in-the-middle (MITM) attack. Here's how to handle it:

Why This Happens
Legitimate Change: The server's SSH key may have been regenerated (e.g., after a reinstall or configuration change).

Security Threat: A malicious actor could be intercepting your connection (MITM attack).

Steps to Fix
1. Verify the New Key (Recommended)
Contact the server administrator to confirm the new fingerprint (SHA256:1BgJjkyV...).

If the change is legitimate, proceed to update the key.

2. Remove the Old Key
The error points to an offending key in C:\Users\cczfk\.ssh\known_hosts (line 6).
Open PowerShell or Command Prompt and run:

sh
ssh-keygen -R 43.156.203.160
This removes the old key entry.

3. Reconnect and Accept the New Key
Try reconnecting via SSH:

sh
ssh user@43.156.203.160
You'll be prompted to accept the new host key. Verify the fingerprint matches the one provided by the server admin before accepting.

4. Alternative: Manually Update known_hosts
If you trust the new key, manually add it by editing C:\Users\cczfk\.ssh\known_hosts and deleting line 6 (or the offending entry).

If You Suspect a MITM Attack
Do not proceed if you can't verify the new fingerprint.

Use a different network (e.g., VPN or mobile hotspot) to rule out local tampering.

Check if the server's IP/domain has been compromised.

Preventing Future Issues
Use ssh-keyscan to fetch keys in advance:

sh
ssh-keyscan 43.156.203.160 >> C:\Users\cczfk\.ssh\known_hosts
Consider SSH certificate-based authentication for better security.

Let me know if you need further clarification!