ssh

SSH 登录失败：Host key verification failed 的解决方法

分类： Ubuntu 2011-10-09 13:21 108人阅读 评论(0) 收藏 举报

1.参考文章

http://www.zhanghaijun.com/post/866/

http://www.anheng.com.cn/news/30032.html

2.错误描述

当我想ssh slave节点时，出现如下错误

hadoop@xuwei-laptop:~$ ssh slave
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for slave has changed,
and the key for the corresponding IP address 192.168.0.42
is unchanged. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
Offending key for IP in /home/hadoop/.ssh/known_hosts:9
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
e1:e0:28:39:6d:fb:d6:45:72:71:c1:ec:3d:ef:78:19.
Please contact your system administrator.
Add correct host key in /home/hadoop/.ssh/known_hosts to get rid of this message.
Offending key in /home/hadoop/.ssh/known_hosts:5
RSA host key for slave has changed and you have requested strict checking.
Host key verification failed.

错误原因是因为我修改过slave节点。就是第一次我ssh slave节点的ip是192.168.0.10，而第二次的时候slave的ip变为了192.168.0.50.这个时候我在使用ssh slave命令就会出现上述错误。

3.问题解释

用OpenSSH的人都知ssh会把你每个你访问过计算机的公钥(public key)都记录在~/.ssh/known_hosts。当下次访问相同计算机时，OpenSSH会核对公钥。如果公钥不同，OpenSSH会发出警告，避免你受到DNS Hijack之类的攻击。因此我们现在只需要删除knows_hosts文件中所对应的slave节点的公钥，然后再ssh slave就可以了。我们使用命令

sudo gedit known_hosts

打开known_hosts，但是我们发现文件内的内容根本找不到slave，文件内容如下

|1|Xv9OoqvMzLO8ZB6RBgo5huXiJsM=|zwBphczddm/ogCsQfJJb8pO8CNo= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3fvljAowPKD9Lx4GkF75FQfj1edEPLTsY9TQv7S5mDS6RB8YvgP9SQxnqt0Dr+IpiDpRg6y7iv6Qm6WC4dOd4jJCPfbI4FUbGTkwLL4qeKo0+ZHZUS2ByeMd+PbqM0iIubKBsNBebA5c+RvqOCneYHOkrTKtwJsq2NnwhgFBz0odeFF7G7tBq6huK7KqikXZauEk7B4gnbtSiD2pG1XZzEUeXq8qEFLjWFPKBRYr8/AL/RZjktJRj98mCRtXCB9tef3DhFkHnXODfC/LzMX3vkQP2ahP4kbNmtXM8nkK2YFx0emAL07h66j89k9ByXzuN0mGw2QKcjFkDWNVkwk6CQ==
|1|peUXkOx+hnb6XQZZGGwMhOXAj04=|mqdXqRTi/MiqARL+dylDygmDgpk= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3fvljAowPKD9Lx4GkF75FQfj1edEPLTsY9TQv7S5mDS6RB8YvgP9SQxnqt0Dr+IpiDpRg6y7iv6Qm6WC4dOd4jJCPfbI4FUbGTkwLL4qeKo0+ZHZUS2ByeMd+PbqM0iIubKBsNBebA5c+RvqOCneYHOkrTKtwJsq2NnwhgFBz0odeFF7G7tBq6huK7KqikXZauEk7B4gnbtSiD2pG1XZzEUeXq8qEFLjWFPKBRYr8/AL/RZjktJRj98mCRtXCB9tef3DhFkHnXODfC/LzMX3vkQP2ahP4kbNmtXM8nkK2YFx0emAL07h66j89k9ByXzuN0mGw2QKcjFkDWNVkwk6CQ==
|1|2Agq45UHkRDXi73GGuTp7+ONWyQ=|wfAq9PffuqQch0E1tsFJDGlAPQk= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3fvljAowPKD9Lx4GkF75FQfj1edEPLTsY9TQv7S5mDS6RB8YvgP9SQxnqt0Dr+IpiDpRg6y7iv6Qm6WC4dOd4jJCPfbI4FUbGTkwLL4qeKo0+ZHZUS2ByeMd+PbqM0iIubKBsNBebA5c+RvqOCneYHOkrTKtwJsq2NnwhgFBz0odeFF7G7tBq6huK7KqikXZauEk7B4gnbtSiD2pG1XZzEUeXq8qEFLjWFPKBRYr8/AL/RZjktJRj98mCRtXCB9tef3DhFkHnXODfC/LzMX3vkQP2ahP4kbNmtXM8nkK2YFx0emAL07h66j89k9ByXzuN0mGw2QKcjFkDWNVkwk6CQ==
|1|GT/tN5xUgbRZhRt31sCAnpWPtH4=|mkxeWxXDrk9XSLo2DtIwvD/J9w4= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3fvljAowPKD9Lx4GkF75FQfj1edEPLTsY9TQv7S5mDS6RB8YvgP9SQxnqt0Dr+IpiDpRg6y7iv6Qm6WC4dOd4jJCPfbI4FUbGTkwLL4qeKo0+ZHZUS2ByeMd+PbqM0iIubKBsNBebA5c+RvqOCneYHOkrTKtwJsq2NnwhgFBz0odeFF7G7tBq6huK7KqikXZauEk7B4gnbtSiD2pG1XZzEUeXq8qEFLjWFPKBRYr8/AL/RZjktJRj98mCRtXCB9tef3DhFkHnXODfC/LzMX3vkQP2ahP4kbNmtXM8nkK2YFx0emAL07h66j89k9ByXzuN0mGw2QKcjFkDWNVkwk6CQ==
|1|hMbmluXaSJKOv4bZydZ75Ye3OUc=|rcfbiV7hrXoaDt02BrVb9UxJSqI= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0d8quvKVdc0b620eAY46ucB87dK/Q1EqEsPOdUltfEpr7/r9hCG+yJqjM6l3roOzkkc9Fi/iZEx0pvIgDdtD+n5YEQrQu81/mj1cWXmkN9xuXvqv9BZxOTeETRF5g1cL0yr4T91CmvXIMewUzv1fE1pWOzZvMKj8SqMOn7PpTjQhpDoS8SkTuNO81k41DkyrDe3DIRL0yC6aUGTF3YOTAe4DbpF8jMHD3+wDm4JT//ULRNKSwRQPOb57XWHy9GLHm89oOm2e8wrjrz84nCRJ5hgJdsjaPt3qJEEGeb8OAMj2fevyu+e1KDF3KExSE0jGBegEWpJilxaD8AV4+1CHsw==
|1|5BwBb0f3G3TO2JJ0ATWbGrFOfjA=|Mr+5xsBD6SDMpg9ITPpDT3r6ULc= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0d8quvKVdc0b620eAY46ucB87dK/Q1EqEsPOdUltfEpr7/r9hCG+yJqjM6l3roOzkkc9Fi/iZEx0pvIgDdtD+n5YEQrQu81/mj1cWXmkN9xuXvqv9BZxOTeETRF5g1cL0yr4T91CmvXIMewUzv1fE1pWOzZvMKj8SqMOn7PpTjQhpDoS8SkTuNO81k41DkyrDe3DIRL0yC6aUGTF3YOTAe4DbpF8jMHD3+wDm4JT//ULRNKSwRQPOb57XWHy9GLHm89oOm2e8wrjrz84nCRJ5hgJdsjaPt3qJEEGeb8OAMj2fevyu+e1KDF3KExSE0jGBegEWpJilxaD8AV4+1CHsw==
|1|UVN6ra08UPwZpm4ZmW6YjAC2Zvg=|dDwgm6Ep/OdeicdFkqXJS46gTmo= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3fvljAowPKD9Lx4GkF75FQfj1edEPLTsY9TQv7S5mDS6RB8YvgP9SQxnqt0Dr+IpiDpRg6y7iv6Qm6WC4dOd4jJCPfbI4FUbGTkwLL4qeKo0+ZHZUS2ByeMd+PbqM0iIubKBsNBebA5c+RvqOCneYHOkrTKtwJsq2NnwhgFBz0odeFF7G7tBq6huK7KqikXZauEk7B4gnbtSiD2pG1XZzEUeXq8qEFLjWFPKBRYr8/AL/RZjktJRj98mCRtXCB9tef3DhFkHnXODfC/LzMX3vkQP2ahP4kbNmtXM8nkK2YFx0emAL07h66j89k9ByXzuN0mGw2QKcjFkDWNVkwk6CQ==
|1|QLl8/P9ESKa1gVjgt9CVMT0a1Rw=|HopDtnlmB0JoXC5Y0kAAKMja1EA= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3fvljAowPKD9Lx4GkF75FQfj1edEPLTsY9TQv7S5mDS6RB8YvgP9SQxnqt0Dr+IpiDpRg6y7iv6Qm6WC4dOd4jJCPfbI4FUbGTkwLL4qeKo0+ZHZUS2ByeMd+PbqM0iIubKBsNBebA5c+RvqOCneYHOkrTKtwJsq2NnwhgFBz0odeFF7G7tBq6huK7KqikXZauEk7B4gnbtSiD2pG1XZzEUeXq8qEFLjWFPKBRYr8/AL/RZjktJRj98mCRtXCB9tef3DhFkHnXODfC/LzMX3vkQP2ahP4kbNmtXM8nkK2YFx0emAL07h66j89k9ByXzuN0mGw2QKcjFkDWNVkwk6CQ==
|1|QZa400OJbWjQNrKTQdqlNvJkyEs=|yVD3EAylkfJaW43kRSUIFcJla10= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3fvljAowPKD9Lx4GkF75FQfj1edEPLTsY9TQv7S5mDS6RB8YvgP9SQxnqt0Dr+IpiDpRg6y7iv6Qm6WC4dOd4jJCPfbI4FUbGTkwLL4qeKo0+ZHZUS2ByeMd+PbqM0iIubKBsNBebA5c+RvqOCneYHOkrTKtwJsq2NnwhgFBz0odeFF7G7tBq6huK7KqikXZauEk7B4gnbtSiD2pG1XZzEUeXq8qEFLjWFPKBRYr8/AL/RZjktJRj98mCRtXCB9tef3DhFkHnXODfC/LzMX3vkQP2ahP4kbNmtXM8nkK2YFx0emAL07h66j89k9ByXzuN0mGw2QKcjFkDWNVkwk6CQ==
|1|yp3zvqWQ6ChoV+KJiRhaNUHVaaA=|Zh9+UnUaW8W1XTCXh8oaOjnsCGM= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAs6IHrmuZwTilgYsOjwiOfQP1u1c3Aj6MH2EOaypGYxccDddcQu6QoKhVXQZWMZFt7W6MeZUa/QKqNVmcpho4NubyCpxfkBIybPzqbqQif8EmYrCCsbaU41hQppISrXNdlcn/S7TKM9T6sbQV1/moYScjQ4kEO+MchVmuIY5cm8kz5p8jxklSF2xFftB+kz7RmMJN3+GcGHOcgACngtxqFnqXfNF8RV1wv2lP5wLui7cv7V+pogExckzqiNfJMPnt8SCMvODHVMRnlJC5yOtpkDKH29X056KeYtK40KhMCQL9UMHfRPQgvQL0qArQ65RLevIckZ8YehOG9aCXbcWzBw==
|1|QLuhhDXvYoefLiZ7+fw5A9ErlV4=|bWOSl44257+rbK1Fn4zwMY8GE3c= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAs6IHrmuZwTilgYsOjwiOfQP1u1c3Aj6MH2EOaypGYxccDddcQu6QoKhVXQZWMZFt7W6MeZUa/QKqNVmcpho4NubyCpxfkBIybPzqbqQif8EmYrCCsbaU41hQppISrXNdlcn/S7TKM9T6sbQV1/moYScjQ4kEO+MchVmuIY5cm8kz5p8jxklSF2xFftB+kz7RmMJN3+GcGHOcgACngtxqFnqXfNF8RV1wv2lP5wLui7cv7V+pogExckzqiNfJMPnt8SCMvODHVMRnlJC5yOtpkDKH29X056KeYtK40KhMCQL9UMHfRPQgvQL0qArQ65RLevIckZ8YehOG9aCXbcWzBw==

        OpenSSH在4.0p1引入了 Hash Known Hosts功能，在known_hosts中把访问过的计算机名称或IP地址以hash方式存放，令入侵都不能直接知道你到访过那些计算机。这项新项功能缺省是关闭的，要你手动地在ssh_config加上\"HashKnownHosts yes\"才会被开启。不过Ubuntu就缺省开启了个功能。
        然而，偶然一些计算机的ssh公钥是合理地被更动。虽然遇到这些情况OpenSSH会发出惊告并禁止你进入该计算机。以往当我们确定该次 ssh公钥被更动没有可疑时，我们用文字编辑器开启known_hosts，把相关的公钥记录删掉就可以了。但现在因为所有计算机名称或IP地址都被 hash了，我们很难知道那行是相关计算机的公钥。当然我们可以把整个known_hosts删除，但我们会同时失去其他正常计算机的ssh公钥。 事实上OpenSSH在工具ssh-keygen加了三个选项，协助你管理hash了的known_hosts。你可以用\"ssh-keygen -F 计算机名称\"找出相关的公钥，使用如下命令找出slave所对应的公钥

ssh-keygen -F slave

执行命令以后得到如下内容：

# Host slave found: line 5 type RSA
|1|hMbmluXaSJKOv4bZydZ75Ye3OUc=|rcfbiV7hrXoaDt02BrVb9UxJSqI= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA0d8quvKVdc0b620eAY46ucB87dK/Q1EqEsPOdUltfEpr7/r9hCG+yJqjM6l3roOzkkc9Fi/iZEx0pvIgDdtD+n5YEQrQu81/mj1cWXmkN9xuXvqv9BZxOTeETRF5g1cL0yr4T91CmvXIMewUzv1fE1pWOzZvMKj8SqMOn7PpTjQhpDoS8SkTuNO81k41DkyrDe3DIRL0yC6aUGTF3YOTAe4DbpF8jMHD3+wDm4JT//ULRNKSwRQPOb57XWHy9GLHm89oOm2e8wrjrz84nCRJ5hgJdsjaPt3qJEEGeb8OAMj2fevyu+e1KDF3KExSE0jGBegEWpJilxaD8AV4+1CHsw==

上述给出了slave的公钥，以及在所在的行数。我们去known_hosts中找到对应的公钥将其删除