Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Change from weak ssh host key to strong one
Operating Systems Solaris Change from weak ssh host key to strong one Post 303036682 by rbatte1 on Monday 8th of July 2019 05:35:10 AM
Old 07-08-2019
Just came across this. One thing to be aware of is that all clients will object when you next try to connect them. They will alert on there being a possible man-in-the-middle attack or a DNS attack that is trying to send you to a different host (as determined by the keys) so you would need to get each client to forget the server keys for the machine(s) you are replacing the keys on and re-validate them all, or manually replace the old key with the new on all the clients.

You need to consider all the names that the clients could refer to the server as, be that IP, local hosts, DNS short name, fully qualified DNS name, DNS alias etc. and look for those in ~/.ssh/known_hosts

You will need to do this for every account on every client, so it is not a thing to be done lightly, especially if there are multiple automated jobs that connect with SSH, SCP, SFTP etc. that you need to ensure are not disrupted.


Sorry if I've made you panic, but better that than a massive failure.



I hope that this helps,
Robin
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

change user> to user@host> ssh prompt

Hi, I was wondering how to change the prompt for my ssh login. At the moment it is like user> while I'd like it to be as user@host> It is in the .bash_profile or .ssh ??? Thanks (2 Replies)
Discussion started by: pmasterkim
2 Replies

2. UNIX for Advanced & Expert Users

RSA host key addition

Guys How do i add RSA key for a host ? I was able to connect to a host some time back but now its not connectable ,via SSH. Message i get is : abhi@myHost:~/.ssh> ssh eatcid@yourHost @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION... (3 Replies)
Discussion started by: ak835
3 Replies

3. Shell Programming and Scripting

Using ssh to add register key on ssh server

Hi, I want to use ssh to add a register key on remote ssh server. Since there are space characters in my register key string, it always failed. If there is no space characters in the string, it worked fine. The following is what I have tried. It seems that "ssh" command doesn't care about double... (9 Replies)
Discussion started by: leaftree
9 Replies

4. UNIX for Advanced & Expert Users

Help! How to find the local host after few ssh hops to remote host???

I do a ssh to remote host(A1) from local host(L1). I then ssh to another remote(A2) from A1. When I do a who -m from A2, I see the "connected from" as "A1". => who -m userid pts/2 2010-03-27 08:47 (A1) I want to identify who is the local host who initiated the connection to... (3 Replies)
Discussion started by: gomes1333
3 Replies

5. Shell Programming and Scripting

Host Key verification failed

Hi, I am running a script to scp a file from one server to another. I have created the public/private key and copied the public key to the other server and appended it to authorized_key file. But i am getting the error message saying "Host Key verification failed" Connection lost. It works well... (3 Replies)
Discussion started by: ahamed
3 Replies

6. UNIX for Dummies Questions & Answers

host key issue via java

Hi, I am encountering below mentioned exception when I execute my Java program that is supposed to SFTP the file from one server over to another. Can you please tell me some pointers to resolve this issue? Exception HostName- 10.1.1.1 ; userName- bmsftp log4j:WARN No appenders could be... (0 Replies)
Discussion started by: prashant.ladha
0 Replies

7. Solaris

Solaris 8 ssh public key authentication issue - Server refused our key

Hi, I've used the following way to set ssh public key authentication and it is working fine on Solaris 10, RedHat Linux and SuSE Linux servers without any problem. But I got error 'Server refused our key' on Solaris 8 system. Solaris 8 uses SSH2 too. Why? Please help. Thanks. ... (1 Reply)
Discussion started by: aixlover
1 Replies

8. Solaris

Ssh between servers - No DSA host key is known

It seems I can do ssh <IP> but not ssh <hostname> If I try to ssh to hostname I get the error - No DSA host key is known for host1 and you have requested strict checking. Host key verification failed. Where do I set up the DSA keys? Is it ssh_known_hosts? Assume afterwards I can... (3 Replies)
Discussion started by: psychocandy
3 Replies

9. UNIX for Beginners Questions & Answers

Host key verification failed error

HI i am getting host key verification failed error. # cat id_rsa.pub | ssh root@10.110.51.245 'cat >> .ssh/authorized_keys;exit;' cat: id_rsa.pub: No such file or directory @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! ... (3 Replies)
Discussion started by: scriptor
3 Replies

10. Forum Support Area for Unregistered Users & Account Problems

Password sent via reset password email is 'weak' and won't allow me to change my password

I was unable to login and so used the "Forgotten Password' process. I was sent a NEWLY-PROVIDED password and a link through which my password could be changed. The NEWLY-PROVIDED password allowed me to login. Following the provided link I attempted to update my password to one of my own... (1 Reply)
Discussion started by: Rich Marton
1 Replies

LEARN ABOUT CENTOS

ipa-client-automount

ipa-client-automount(1) 					 IPA Manual Pages					   ipa-client-automount(1)

NAME

       ipa-client-automount - Configure automount and NFS for IPA

SYNOPSIS

       ipa-client-automount [OPTION]... <location>

DESCRIPTION

       Configures automount for IPA.

       The automount configuration consists of three files:

       o      /etc/nsswitch.conf

       o      /etc/sysconfig/autofs

       o      /etc/autofs_ldap_auth.conf

       By  default  this will use DNS discovery to attempt to determine the IPA server(s) to use. If IPA servers are discovered then the automount
       client will be configured to use DNS discovery.

       If DNS discovery fails or a specific server is desired, use the --server option.

       The default automount location is named default. To specify a different one use the --location option.

       The IPA client must already be configured in order to configure automount. The IPA client is configured as part of a server installation.

       There are two ways to configure automount. The default is to use sssd to manage the automount maps. Alternatively autofs can configured	to
       bind to LDAP over GSSAPI and authenticate using the machine's host principal.

       The nsswitch automount service is configured to use either sss or ldap and files depending on whether SSSD is configured or not.

       NFSv4 is also configured. The rpc.gssd and rpc.idmapd are started on clients to support Kerberos-secured mounts.

OPTIONS

       --server=SERVER Set the IPA server to connect to

       --location=LOCATION
	      Automount location

       -S, --no-sssd
	      Do not configure the client to use SSSD for automount

       -d, --debug
	      Print debugging information to stdout

       -U, --unattended
	      Unattended installation. The user will not be prompted

       --uninstall
	      Restore the automount configuration files

FILES

       Files that will be always be configured:

	      /etc/nsswitch.conf

       Files that will be configured when SSSD is the automount client (default):

	      /etc/sssd/sssd.conf

       Files that will be configured when using the ldap automount client:

	      /etc/sysconfig/autofs

	      /etc/autofs_ldap_auth.conf

EXIT STATUS

       0 if the installation was successful

       1 if an error occurred

IPA
								    May 25 2012 					   ipa-client-automount(1)
All times are GMT -4. The time now is 03:55 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy