Scott Moser
2010-Dec-09 15:27 UTC
[PATCH] mention ssh-keyscan in remote host fingerprint warning
Hi, below is a patch to simply mention 'ssh-keygen' when a fingerprint does not match between the known_hosts file and the remote. I find that many people are unaware that ssh-keygen can do this for them. adding a copy-and-pasteable message in the warning will make users more aware. Description: Mention ssh-keygen in ssh fingerprint changed warning Author: Scott Moser <smoser at ubuntu.com> Bug: https://launchpad.net/bugs/686607 Index: openssh/sshconnect.c ==================================================================--- openssh.orig/sshconnect.c 2010-12-09 10:21:33.889760054 -0500 +++ openssh/sshconnect.c 2010-12-09 10:22:02.139864915 -0500 @@ -908,14 +908,17 @@ error("%s. This could either mean that", key_msg); error("DNS SPOOFING is happening or the IP address for the host"); error("and its host key have changed at the same time."); - if (ip_status != HOST_NEW) + if (ip_status != HOST_NEW) { error("Offending key for IP in %s:%d", ip_file, ip_line); + error(" remove with: ssh-keygen -f \"%s\" -R %d", ip_file, ip_line); + } } /* The host key has changed. */ warn_changed_key(host_key); error("Add correct host key in %.100s to get rid of this message.", user_hostfile); error("Offending key in %s:%d", host_file, host_line); + error(" remove with: ssh-keygen -f \"%s\" -R %d", host_file, host_line); /* * If strict host key checking is in use, the user will have