07-08-2019
Just came across this. One thing to be aware of is that all clients will object when you next try to connect them. They will alert on there being a possible man-in-the-middle attack or a DNS attack that is trying to send you to a different host (as determined by the keys) so you would need to get each client to forget the server keys for the machine(s) you are replacing the keys on and re-validate them all, or manually replace the old key with the new on all the clients.
You need to consider all the names that the clients could refer to the server as, be that IP, local hosts, DNS short name, fully qualified DNS name, DNS alias etc. and look for those in ~/.ssh/known_hosts
You will need to do this for every account on every client, so it is not a thing to be done lightly, especially if there are multiple automated jobs that connect with SSH, SCP, SFTP etc. that you need to ensure are not disrupted.
Sorry if I've made you panic, but better that than a massive failure.
I hope that this helps,
Robin
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hi, I was wondering how to change the prompt for my ssh login. At the moment it is like
user>
while I'd like it to be as
user@host>
It is in the .bash_profile or .ssh ??? Thanks (2 Replies)
Discussion started by: pmasterkim
2 Replies
2. UNIX for Advanced & Expert Users
Guys
How do i add RSA key for a host ?
I was able to connect to a host some time back but now its not connectable ,via SSH.
Message i get is :
abhi@myHost:~/.ssh> ssh eatcid@yourHost
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION... (3 Replies)
Discussion started by: ak835
3 Replies
3. Shell Programming and Scripting
Hi,
I want to use ssh to add a register key on remote ssh server. Since there are space characters in my register key string, it always failed. If there is no space characters in the string, it worked fine. The following is what I have tried. It seems that "ssh" command doesn't care about double... (9 Replies)
Discussion started by: leaftree
9 Replies
4. UNIX for Advanced & Expert Users
I do a ssh to remote host(A1) from local host(L1). I then ssh to another remote(A2) from A1.
When I do a who -m from A2, I see the "connected from" as "A1".
=> who -m
userid pts/2 2010-03-27 08:47 (A1)
I want to identify who is the local host who initiated the connection to... (3 Replies)
Discussion started by: gomes1333
3 Replies
5. Shell Programming and Scripting
Hi,
I am running a script to scp a file from one server to another.
I have created the public/private key and copied the public key to the other server and appended it to authorized_key file.
But i am getting the error message saying "Host Key verification failed" Connection lost.
It works well... (3 Replies)
Discussion started by: ahamed
3 Replies
6. UNIX for Dummies Questions & Answers
Hi,
I am encountering below mentioned exception when I execute my Java program that is supposed to SFTP the file from one server over to another.
Can you please tell me some pointers to resolve this issue?
Exception
HostName- 10.1.1.1 ; userName- bmsftp
log4j:WARN No appenders could be... (0 Replies)
Discussion started by: prashant.ladha
0 Replies
7. Solaris
Hi, I've used the following way to set ssh public key authentication and it is working fine on Solaris 10, RedHat Linux and SuSE Linux servers without any problem. But I got error 'Server refused our key' on Solaris 8 system. Solaris 8 uses SSH2 too. Why? Please help. Thanks.
... (1 Reply)
Discussion started by: aixlover
1 Replies
8. Solaris
It seems I can do ssh <IP> but not ssh <hostname>
If I try to ssh to hostname I get the error - No DSA host key is known for host1 and you have requested strict checking.
Host key verification failed.
Where do I set up the DSA keys? Is it ssh_known_hosts?
Assume afterwards I can... (3 Replies)
Discussion started by: psychocandy
3 Replies
9. UNIX for Beginners Questions & Answers
HI
i am getting host key verification failed error.
# cat id_rsa.pub | ssh root@10.110.51.245 'cat >> .ssh/authorized_keys;exit;'
cat: id_rsa.pub: No such file or directory
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! ... (3 Replies)
Discussion started by: scriptor
3 Replies
10. Forum Support Area for Unregistered Users & Account Problems
I was unable to login and so used the "Forgotten Password' process. I was sent a NEWLY-PROVIDED password and a link through which my password could be changed. The NEWLY-PROVIDED password allowed me to login.
Following the provided link I attempted to update my password to one of my own... (1 Reply)
Discussion started by: Rich Marton
1 Replies
LEARN ABOUT CENTOS
ipa-replica-install
ipa-replica-install(1) IPA Manual Pages ipa-replica-install(1)
NAME
ipa-replica-install - Create an IPA replica
SYNOPSIS
ipa-replica-install [OPTION]... replica_file
DESCRIPTION
Configures a new IPA server that is a replica of the server that generated it. Once it has been created it is an exact copy of the original
IPA server and is an equal master. Changes made to any master are automatically replicated to other masters.
The replica_file is created using the ipa-replica-prepare utility.
If the installation fails you may need to run ipa-server-install --uninstall before running ipa-replica-install again.
The installation will fail if the host you are installing the replica on exists as a host in IPA or an existing replication agreement
exists (for example, from a previously failed installation).
A replica should only be installed on the same or higher version of IPA on the remote system.
OPTIONS
BASIC OPTIONS
--setup-ca
Install and configure a CA on this replica. If a CA is not configured then certificate operations will be forwarded to a master with
a CA installed.
--ip-address=IP_ADDRESS
The IP address of this server. If this address does not match the address the host resolves to and --setup-dns is not selected the
installation will fail. If the server hostname is not resolvable, a record for the hostname and IP_ADDRESS is added to /etc/hosts.
-p DM_PASSWORD, --password=DM_PASSWORD
Directory Manager (existing master) password
-w ADMIN_PASSWORD, --admin-password=ADMIN_PASSWORD
Admin user Kerberos password used for connection check
--mkhomedir
Create home directories for users on their first login
-N, --no-ntp
Do not configure NTP
--no-ui-redirect
Do not automatically redirect to the Web UI.
--ssh-trust-dns
Configure OpenSSH client to trust DNS SSHFP records.
--no-ssh
Do not configure OpenSSH client.
--no-sshd
Do not configure OpenSSH server.
--skip-conncheck
Skip connection check to remote master
-d, --debug
Enable debug logging when more verbose output is needed
-U, --unattended
An unattended installation that will never prompt for user input
CERTIFICATE SYSTEM OPTIONS
--skip-schema-check
Skip check for updated CA DS schema on the remote master
DNS OPTIONS
--setup-dns
Generate a DNS zone if it does not exist already and configure the DNS server. This option requires that you either specify at
least one DNS forwarder through the --forwarder option or use the --no-forwarders option.
--forwarder=IP_ADDRESS
Add a DNS forwarder to the DNS configuration. You can use this option multiple times to specify more forwarders, but at least one
must be provided, unless the --no-forwarders option is specified.
--no-forwarders
Do not add any DNS forwarders. Root DNS servers will be used instead.
--reverse-zone=REVERSE_ZONE
The reverse DNS zone to use
--no-reverse
Do not create new reverse DNS zone. If a reverse DNS zone already exists for the subnet, it will be used.
--no-host-dns
Do not use DNS for hostname lookup during installation
--no-dns-sshfp
Do not automatically create DNS SSHFP records.
EXIT STATUS
0 if the command was successful
1 if an error occurred
3 if the host exists in the IPA server or a replication agreement to the remote master already exists
IPA
May 16 2012 ipa-replica-install(1)