4

Why am I getting this warning when trying to SSH into my RPi2? It also happens when I try from my MBP.

todd@dell-Vostro-3550:~$ ssh [email protected]
The authenticity of host '10.0.1.53 (10.0.1.53)' can't be established.
ECDSA key fingerprint is 55:5b:0a:76:40:17:61:3f:58:43:74:3b:54:d7:88:34.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/todd/.ssh/known_hosts).
[email protected]'s password: 
Linux RASPi2 3.18.7-v7+ #755 SMP PREEMPT Thu Feb 12 17:20:48 GMT 2015 armv7l

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Mar 19 15:35:56 2015 from 10.0.1.49
pi@RASPi2 ~ $
Improve this question

5 Answers 5

Reset to default
1

You don't actually need to keep this information (the stuff inknown_hosts) anyway if you are just on a home LAN. In fact, it can be more than useless and there's a reason to not want to keep it (see below). No one is going to spoof you anyway. So, this should work on POSIX compliant systems (which includes both OS X and Linux):

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no ...

Add those options (they are tiresome to type, so probably you want to create an alias or something) and:

  • It will just write to /dev/null, which is world writable.

  • You will preempt another irritating message that will occur even if everything is working properly, namely:

      Warning: the ECDSA host key for '[raspberry.pi]' differs 
  from the key for the IP address '[192.168.0.21]'
  Offending key for IP in /root/.ssh/known_hosts:25
  Matching host key in /root/.ssh/known_hosts:3
  Are you sure you want to continue connecting (yes/no)?

This happens if you are using DHCP (i.e., you did not assign the Pi a static address) because the local addresses (192.168.0.21, etc) tend to change. Using the above options, ssh will think it has never seen this place before, therefore there can be no such problem.

Improve this answer
4
  • Ok the problem went away after multiple SSH sessions between my Mac and my Trusty install. I am on a LAN so it I s very doubtful that I have been compromised.
    – Todd
    Commented Mar 22, 2015 at 5:44
  • But, but, but... the whole idea of ssh is to keep things secure so if something is not right don't you want to know that you have been compromised - even if there is a little noise about IP addresses changing? 8-/
    – SlySven
    Commented Dec 31, 2015 at 19:21
  • @SlySven This is why I prefaced it "if you are just on a home LAN...no one is going to spoof you anyway". Of course, if you are convinced that your LAN is not generally safe, then you might not want to do this. There is a difference between privacy and security. SSH can help to ensure both, but if the latter is not really an issue then the former is the only purpose. By analogy, your bathroom door at home is probably not secure -- it and the lock are really just for privacy.
    – goldilocks ♦
    Commented Dec 31, 2015 at 19:30
  • @goldilocks Yeah - I get your point - I live alone and I don't usually bother to even shut the door... 8-)
    – SlySven
    Commented Dec 31, 2015 at 19:32
2

Hmmm, you should only get that message the first time you connect to a new host.

You've got an error though, that points to a problem:

Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/todd/.ssh/known_hosts).

Make sure that /home/todd/.ssh is owned by "todd" and has permissions similar 755. If that is correct, check to see if there is already a known_hosts file under .ssh. If there is, check that it too is owned by "todd" and has perms of 600.

Improve this answer
1
  • ~/.ssh MUST be 700 (read/write/execute for owner - no access for same group members or other user) - sshd watches for this and will be unhappy if those are not the permissions. This is because that directory holds your PRIVATE key parts as well as the corresponding PUBLIC key for YOUR key-pairs - NOONE else should have access to your PRIVATE keys...!
    – SlySven
    Commented Dec 31, 2015 at 19:15
2

The line:

Failed to add the host to the list of known hosts (/home/todd/.ssh/known_hosts).

is the problem. I suspect you are seeing this fingerprint warning every time you login? The reason is because ssh is not able to record the host key in your known_hosts file.

Make sure the file exists and its permissions are correct. Running these commands should resolve the error you're getting:

mkdir ~/.ssh
sudo chown -R $USER ~/.ssh
touch ~/.ssh/known_hosts
chmod 700 ~/.ssh/known_hosts
Improve this answer
10
  • That is true it does occur every time I connect, in fact it's been about 6 hrs since I reformatted the SD with noobs I had on it originally. I reformatted and installed Raspbian Wheezy on the SD, how ever I failed to check the md5 or the sha1 before installing on the SD.
    – Todd
    Commented Mar 20, 2015 at 0:05
  • The RPi2 is headless so I ssh into it to manage it. I have been the unsuccessful using VNC but that is another long story and another question. I will attempt your answer but of course I must ssh into it to run these commands or I must extricate from from behind the TV and hook it up to a computer monitor, keyboard and mouse. I'll respond back later.
    – Todd
    Commented Mar 20, 2015 at 0:15
  • No, these commands should be run on the host you are using to ssh to the pi (your MBP)
    – Mark
    Commented Mar 20, 2015 at 0:17
  • here is the output of the commands given
    – Todd
    Commented Mar 20, 2015 at 0:58
  • todd@dell-Vostro-3550:~$ mkdir ~/.ssh mkdir: cannot create directory ‘/home/todd/.ssh’: File exists todd@dell-Vostro-3550:~$ touch ~/.ssh/known_hosts touch: cannot touch ‘/home/todd/.ssh/known_hosts’: Permission denied todd@dell-Vostro-3550:~$ chmod 700 ~/.ssh/known_hosts chmod: changing permissions of ‘/home/todd/.ssh/known_hosts’: Operation not permitted todd@dell-Vostro-3550:~$
    – Todd
    Commented Mar 20, 2015 at 0:58
2

I stumbled upon the same problem...trying to set up a R Pi home server.

It's telling you that you've never connected to that particular server before. It's expected and apparenly quite normal in this situation. You could also ( if you want to make sure) confirm the checksum/fingerprint of the key using an alternate channel. However, if somebody can redirect your SSH, then your web browser can be redirected as well.

So basically... either you have been handed a new ssh or it's warning you of the possiblity, that there is a 'third part'. ( called 'man in the middle attack')

check link below if interested. https://en.wikipedia.org/wiki/Man-in-the-middle_attack

Hope this makes things a bit more clear.

Improve this answer
1
  • 1
    +1 Yes, this is a "I've never seen this identity before" alert - and you've hit the nail on the head - it's to be expected for a first connection but if it pops up for one you've used before, it could be a MITM attack.
    – SlySven
    Commented Dec 31, 2015 at 19:09
1

This is normal part of the SSH protocol, it is a security feature. The first time you connect to a new server you won't have a stored key for the server. Because the key does not exist in the known servers list, so it is asking you whether to trust the remote machine or not. if you answer no you won't be able to connect. If you accept the key, it will be stored and you won't normally see the message again - if you do either the server's key has changed or it indicates malicious activity and you should investigate further. You can read more about the key fingerprint and how to verify it here.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.