Tech Notes :- ssh failure Offending RSA key in /var/lib/sss/pubconf/known_hosts

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:gEFs4gmKdgDsV2n3UhB/lNhZ/sLSM8q+5VIbl+D1S3c.
Please contact your system administrator.
Add correct host key in /dev/null to get rid of this message.
Offending RSA key in /var/lib/sss/pubconf/known_hosts:8
Password authentication is disabled to avoid man-in-the-middle attacks.
Keyboard-interactive authentication is disabled to avoid man-in-the-middle attacks.

This is not a normal ssh error that can be fixed by editing ~/.ssh/known_hosts and removing the relevant key entries or by using the command ssh-keygen -f ~/.ssh/known_hosts -R <host>. If you try to do it, the key will come back and ends up with the same error.

Another option that we are tempted to try is to remove the offending key from /var/lib/sss/pubconf/known_hosts. This also will end in failure

Most probably this error occurs when the server was part of  IPA setup and you just re-installed the server without removing the relevant configuration from the IPA server.In this case IPA server will still have the keys associated with the server before it got re-installed and we have to first remove the keys from the IPA server.

You can do that from the IPA Identity Management Web UI by browsing to Hosts--> <yourhostname> -->Settings. Now scroll down to the SSH Public keys section and then remove the keys and save it.

Now you should be able to login to your server using ssh as usual.

Tech Notes:- SSH Login Without Password

There are certain circumstances which demand login to mutiple linux servers/desktops without a password. One such situation is to initiate a remote shutdown script to shutdown all servers/desktops in a network. So how do you do it.Here is how it is



Create public key and private key using ssh-key-gen on local machine

sudeep@local-host$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/sudeep/.ssh/id_rsa):[Enter key]
Enter passphrase (empty for no passphrase): [Press enter key]
Enter same passphrase again: [Pess enter key]
Your identification has been saved in /home/sudeep/.ssh/id_rsa.
Your public key has been saved in /home/sudeep/.ssh/id_rsa.pub.
The key fingerprint is:
22:b3:42:cf:a5:b5:28:11:21:c5:be:26:2c:f3:3b:f9 sudeep@local-host

Copy the created public key to remote host using ssh-copy-id


sudeep@local-host$ ssh-copy-id -i ~/.ssh/id_rsa.pub remote-host
sudeep@remote-host's password:

ssh-copy-id appends the keys to the remote-host's .ssh/authorized_key



Now try login to the remote host without password

sudeep@local-host$ ssh remote-host
Last login: Thu Feb 24 21:58:45 2008 from 10.0.0.5
[Note: SSH should not ask for password here.]

sudeep@remote-host$ [Note: You should be on remote-host here]

Using ssh-copy-id along with the ssh-add/ssh-agent

If you have loaded keys to the ssh-agent using the ssh-add, then ssh-copy-id will get the keys from the ssh-agent to copy to the remote-host. That is it copies the keys provided by ssh-add -L command to the remote-host, when you don’t pass option -i to the ssh-copy-id.


sudeep@local-host$ ssh-agent $SHELL
sudeep@local-host$ ssh-add -L
The agent has no identities.

sudeep@local-host$ ssh-add
Identity added: /home/sudeep/.ssh/id_rsa (/home/sudeep/.ssh/id_rsa)

sudeep@local-host$ ssh-add -L
ssh-rsa BBBBA2NzaB2cc1AAAAACIAAAAREcsJLFILxfcR2ASxcA328c62vf72DxbVA
a2rcPHTypq3kIeMUszAPnsxsepe12c/Ow== /home/sudeep/.ssh/id_rsa

sudeep@local-host$ ssh-copy-id -i remote-host
sudeep@remote-host's password:

Now try logging into the machine, with "ssh 'remote-host'", and check in:
.ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.
[Note: This has added the key displayed by ssh-add -L]