thr3ads.net - CentOS - [CentOS] Centos hold me back from work

If this information is useful, please help other people find it:
Share via:

Andreas Benzler

2016-Apr-28 09:09 UTC

[CentOS] Centos hold me back from work - sshd ...bull

ine-imac-andy:~ andy$ ssh 141.52.135.21
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:KIKE0V+Hm1UW4XtpTAVsl/7QWqJSVoQHfLnjj3vn/nM.
Please contact your system administrator.
Add correct host key in /Users/andy/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /Users/andy/.ssh/known_hosts:22
RSA host key for 141.52.135.21 has changed and you have requested strict
checking.
Host key verification failed.
ine-imac-andy:~ andy$ vi .ssh/
id_rsa       id_rsa.pub   known_hosts  
ine-imac-andy:~ andy$ vi .ssh/known_hosts 
ine-imac-andy:~ andy$ ssh -vvv andy at 141.52.135.21
OpenSSH_6.9p1, LibreSSL 2.1.8
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 141.52.135.21 [141.52.135.21] port 22.
debug1: Connection established.
debug1: identity file /Users/andy/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
write: Broken pipe
ine-imac-andy:~ andy$ ssh -vvv andy at 141.52.135.21
OpenSSH_6.9p1, LibreSSL 2.1.8
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 141.52.135.21 [141.52.135.21] port 22.
debug1: Connection established.
debug1: identity file /Users/andy/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/andy/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1
Debian-5ubuntu1.8
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1.8 pat OpenSSH_5* compat 0x0c000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 141.52.135.21:22 as 'andy'
debug3: hostkeys_foreach: reading file "/Users/andy/.ssh/known_hosts"
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: curve25519-sha256 at
libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01 at
openssh.com,ecdsa-sha2-nistp384-cert-v01 at
openssh.com,ecdsa-sha2-nistp521-cert-v01 at openssh.com,ssh-ed25519-cert-v01 at
openssh.com,ssh-rsa-cert-v01 at openssh.com,ssh-dss-cert-v01 at
openssh.com,ssh-rsa-cert-v00 at openssh.com,ssh-dss-cert-v00 at
openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: chacha20-poly1305 at
openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm at
openssh.com,aes256-gcm at
openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc
at lysator.liu.se
debug2: kex_parse_kexinit: chacha20-poly1305 at
openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm at
openssh.com,aes256-gcm at
openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc
at lysator.liu.se
debug2: kex_parse_kexinit: umac-64-etm at openssh.com,umac-128-etm at
openssh.com,hmac-sha2-256-etm at openssh.com,hmac-sha2-512-etm at
openssh.com,hmac-sha1-etm at openssh.com,umac-64 at openssh.com,umac-128 at
openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5-etm at
openssh.com,hmac-ripemd160-etm at openssh.com,hmac-sha1-96-etm at
openssh.com,hmac-md5-96-etm at
openssh.com,hmac-md5,hmac-ripemd160,hmac-ripemd160 at
openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: umac-64-etm at openssh.com,umac-128-etm at
openssh.com,hmac-sha2-256-etm at openssh.com,hmac-sha2-512-etm at
openssh.com,hmac-sha1-etm at openssh.com,umac-64 at openssh.com,umac-128 at
openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5-etm at
openssh.com,hmac-ripemd160-etm at openssh.com,hmac-sha1-96-etm at
openssh.com,hmac-md5-96-etm at
openssh.com,hmac-md5,hmac-ripemd160,hmac-ripemd160 at
openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib at openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib at openssh.com,zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit:
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss
debug2: kex_parse_kexinit:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc
at lysator.liu.se
debug2: kex_parse_kexinit:
aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc
at lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64 at
openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160
at openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64 at
openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160
at openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib at openssh.com
debug2: kex_parse_kexinit: none,zlib at openssh.com
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug1: kex: server->client aes128-ctr umac-64 at openssh.com none
debug1: kex: client->server aes128-ctr umac-64 at openssh.com none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ssh-rsa
SHA256:KIKE0V+Hm1UW4XtpTAVsl/7QWqJSVoQHfLnjj3vn/nM
debug3: hostkeys_foreach: reading file "/Users/andy/.ssh/known_hosts"
The authenticity of host '141.52.135.21 (141.52.135.21)' can't be
established.
RSA key fingerprint is SHA256:KIKE0V+Hm1UW4XtpTAVsl/7QWqJSVoQHfLnjj3vn/nM.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '141.52.135.21' (RSA) to the list of known
hosts.
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
ssh_packet_read: Connection reset by peer
> Am 28.04.2016 um 11:05 schrieb Earl A Ramirez <earlaramirez at
gmail.com>:
> 
> On 28 Apr 2016 10:58, "Andreas Benzler" <andreas at
benzlerweb.de> wrote:
>> 
>> I don?t know what?s going on
>> 
>> the sushi from the laptop always kick me out!!!
>> 
>> Fresh installation.
>> 
>> packet_write_wait: Connection
>> 
>> How can that be!
>> 
>> Andy
>> 
>> _______________________________________________
>> CentOS mailing list
>> CentOS at centos.org
>> https://lists.centos.org/mailman/listinfo/centos
> 
> You will need to provide a little more information, what's the output
when
> you use ssh -vvv user at host?
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> https://lists.centos.org/mailman/listinfo/centos

John R Pierce

2016-Apr-28 09:15 UTC

head link

[CentOS] Centos hold me back from work - sshd ...bull

On 4/28/2016 2:09 AM, Andreas Benzler wrote:> ine-imac-andy:~ andy$ ssh -vvvandy at 141.52.135.21
> debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1
Debian-5ubuntu1.8
> debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1.8 pat OpenSSH_5* compat
0x0c000000

thats not CentOS.

are you sure you're connecting to the right address ?

-- 
john r pierce, recycling bits in santa cruz

Gordon Messmer

2016-Apr-28 16:25 UTC

head link

[CentOS] Centos hold me back from work - sshd ...bull

On 04/28/2016 02:09 AM, Andreas Benzler wrote:> ine-imac-andy:~ andy$ ssh -vvvandy at 141.52.135.21
...> debug1: Enabling compatibility mode for protocol 2.0
> write: Broken pipe
> ine-imac-andy:~ andy$ ssh -vvvandy at 141.52.135.21
...> debug1: SSH2_MSG_SERVICE_REQUEST sent
> ssh_packet_read: Connection reset by peer

I see one possibility that explains both the key change and the 
connection resets:

You installed a new server and used an IP address that was already in 
use on another server.  That's why you already had an SSH key for that 
address.  The connection resets occur when the client you're using to 
connect updates its ARP table and swaps from the MAC address on the new 
host to the MAC address on the old host (or visa versa).

Valeri Galtsev

2016-Apr-28 16:49 UTC

head link

[CentOS] Centos hold me back from work - sshd ...bull

On Thu, April 28, 2016 11:25 am, Gordon Messmer wrote:> On 04/28/2016 02:09 AM, Andreas Benzler wrote:
>> ine-imac-andy:~ andy$ ssh -vvvandy at 141.52.135.21
> ...
>> debug1: Enabling compatibility mode for protocol 2.0
>> write: Broken pipe
>> ine-imac-andy:~ andy$ ssh -vvvandy at 141.52.135.21
> ...
>> debug1: SSH2_MSG_SERVICE_REQUEST sent
>> ssh_packet_read: Connection reset by peer
>
>
> I see one possibility that explains both the key change and the
> connection resets:
>
> You installed a new server and used an IP address that was already in
> use on another server.  That's why you already had an SSH key for that
> address.  The connection resets occur when the client you're using to
> connect updates its ARP table and swaps from the MAC address on the new
> host to the MAC address on the old host (or visa versa).
Oh yes, and bizarre may happen if you have two machines with the same
static IP _simultaneously_ on the network. To check if that is the case
(for particular IP, say 192.168.2.7) from the machine with different IP on
the same subnet 192.168.2.x do

arping 192.168.2.7

you will get ARP responses from all machines, and if there is more than
one, you will see responces coming from different MAC addresses.

Valeri

++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++

Warren Young

2016-Apr-28 21:36 UTC

head link

[CentOS] Centos hold me back from work - sshd ...bull

On Apr 28, 2016, at 3:15 AM, John R Pierce <pierce at hogranch.com>
wrote:> 
> On 4/28/2016 2:09 AM, Andreas Benzler wrote:
>> ine-imac-andy:~ andy$ ssh -vvvandy at 141.52.135.21
> 
> 
>> debug1: Remote protocol version 2.0, remote software version
OpenSSH_5.9p1 Debian-5ubuntu1.8
>> debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1.8 pat OpenSSH_5* compat
0x0c000000
> 
> 
> thats not CentOS.
> 
> are you sure you're connecting to the right address ?
Many of the other answers are ignoring this detail by simply recommending that
the OP remove the offending line from known_hosts and try again.  That?s an
excellent way to get MITM?d!

When OpenSSH warns you that the remote host?s key is different from the one it
saw before, you *must not ignore it* unless you know exactly why it changed.

Don?t guess!  Verify.

How?

Log into the intended host over some trusted channel, then say:

   for f in /etc/ssh/ssh_host_*_key ; do ssh-keygen -lf $f ; done

If none of those values exactly matches

   SHA256:KIKE0V+Hm1UW4XtpTAVsl/7QWqJSVoQHfLnjj3vn/nM.

then OpenSSH is right to prevent your login.  It means you aren?t connecting to
the server you think you are.  It might be a benign misconfiguration or it might
be a MITM attempt.

This is potentially a game-over scenario.  Don?t ignore it.

See also this article on the TOFU problem:

 https://en.wikipedia.org/wiki/Trust_on_first_use

Maybe Matching Threads

Search for more reasonably related threads

CentOS - Apr 2016 - Centos hold me back from work - sshd ...bull

[CentOS] Centos hold me back from work - sshd ...bull

[CentOS] Centos hold me back from work - sshd ...bull

[CentOS] Centos hold me back from work - sshd ...bull

[CentOS] Centos hold me back from work - sshd ...bull

[CentOS] Centos hold me back from work - sshd ...bull

Maybe Matching Threads