3

Why am I getting this warning when trying to SSH into my RPi2? It also happens when I try from my MBP.

todd@dell-Vostro-3550:~$ ssh pi@10.0.1.53
The authenticity of host '10.0.1.53 (10.0.1.53)' can't be established.
ECDSA key fingerprint is 55:5b:0a:76:40:17:61:3f:58:43:74:3b:54:d7:88:34.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/todd/.ssh/known_hosts).
pi@10.0.1.53's password: 
Linux RASPi2 3.18.7-v7+ #755 SMP PREEMPT Thu Feb 12 17:20:48 GMT 2015 armv7l

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Mar 19 15:35:56 2015 from 10.0.1.49
pi@RASPi2 ~ $ 
1

You don't actually need to keep this information (the stuff in`known_hosts) anyway if you are just on a home LAN. In fact, it can be more than useless and there's a reason to not want to keep it (see below). No one is going to spoof you anyway. So, this should work on POSIX compliant systems (which includes both OSX and linux):

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no ...

Add those options (they are tiresome to type, so probably you want to create an alias or something) and:

  • It will just write to /dev/null, which is world writable.
  • You will preempt another irritating message that will occur even if everything is working properly, namely:

    Warning: the ECDSA host key for '[raspberry.pi]' differs 
    from the key for the IP address '[192.168.0.21]'
    Offending key for IP in /root/.ssh/known_hosts:25
    Matching host key in /root/.ssh/known_hosts:3
    Are you sure you want to continue connecting (yes/no)?
    

This happens if you are using DHCP (i.e., you did not assign the pi a static address) because the local addresses (192.168.0.21, etc) tend to change. Using the above options, ssh will think it has never seen this place before, therefore there can be no such problem.

4
  • Ok the problem went away after multiple SSH sessions between my Mac and my Trusty install. I am on a LAN so it I s very doubtful that I have been compromised. – Todd Mar 22 '15 at 5:44
  • But, but, but... the whole idea of ssh is to keep things secure so if something is not right don't you want to know that you have been compromised - even if there is a little noise about IP addresses changing? 8-/ – SlySven Dec 31 '15 at 19:21
  • @SlySven This is why I prefaced it "if you are just on a home LAN...no one is going to spoof you anyway". Of course, if you are convinced that your LAN is not generally safe, then you might not want to do this. There is a difference between privacy and security. SSH can help to ensure both, but if the latter is not really an issue then the former is the only purpose. By analogy, your bathroom door at home is probably not secure -- it and the lock are really just for privacy. – goldilocks Dec 31 '15 at 19:30
  • @goldilocks Yeah - I get your point - I live alone and I don't usually bother to even shut the door... 8-) – SlySven Dec 31 '15 at 19:32
2

Hmmm, you should only get that message the first time you connect to a new host.

You've got an error though, that points to a problem:

Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/todd/.ssh/known_hosts).

Make sure that /home/todd/.ssh is owned by "todd" and has permissions similar 755. If that is correct, check to see if there is already a known_hosts file under .ssh. If there is, check that it too is owned by "todd" and has perms of 600.

1
  • ~/.ssh MUST be 700 (read/write/execute for owner - no access for same group members or other user) - sshd watches for this and will be unhappy if those are not the permissions. This is because that directory holds your PRIVATE key parts as well as the corresponding PUBLIC key for YOUR key-pairs - NOONE else should have access to your PRIVATE keys...! – SlySven Dec 31 '15 at 19:15
2

The line:

Failed to add the host to the list of known hosts (/home/todd/.ssh/known_hosts).

is the problem. I suspect you are seeing this fingerprint warning every time you login? The reason is because ssh is not able to record the host key in your known_hosts file.

Make sure the file exists and its permissions are correct. Running these commands should resolve the error you're getting:

mkdir ~/.ssh
sudo chown -R $USER ~/.ssh
touch ~/.ssh/known_hosts
chmod 700 ~/.ssh/known_hosts
10
  • That is true it does occur every time I connect, in fact it's been about 6 hrs since I reformatted the SD with noobs I had on it originally. I reformatted and installed Raspbian Wheezy on the SD, how ever I failed to check the md5 or the sha1 before installing on the SD. – Todd Mar 20 '15 at 0:05
  • The RPi2 is headless so I ssh into it to manage it. I have been the unsuccessful using VNC but that is another long story and another question. I will attempt your answer but of course I must ssh into it to run these commands or I must extricate from from behind the TV and hook it up to a computer monitor, keyboard and mouse. I'll respond back later. – Todd Mar 20 '15 at 0:15
  • No, these commands should be run on the host you are using to ssh to the pi (your MBP) – Mark Mar 20 '15 at 0:17
  • here is the output of the commands given – Todd Mar 20 '15 at 0:58
  • todd@dell-Vostro-3550:~$ mkdir ~/.ssh mkdir: cannot create directory ‘/home/todd/.ssh’: File exists todd@dell-Vostro-3550:~$ touch ~/.ssh/known_hosts touch: cannot touch ‘/home/todd/.ssh/known_hosts’: Permission denied todd@dell-Vostro-3550:~$ chmod 700 ~/.ssh/known_hosts chmod: changing permissions of ‘/home/todd/.ssh/known_hosts’: Operation not permitted todd@dell-Vostro-3550:~$ – Todd Mar 20 '15 at 0:58
2

I stumbled upon the same problem...trying to set up a R Pi home server.

It's telling you that you've never connected to that particular server before. It's expected and apparenly quite normal in this situation. You could also ( if you want to make sure) confirm the checksum/fingerprint of the key using an alternate channel. However, if somebody can redirect your SSH, then your web browser can be redirected as well.

So basically... either you have been handed a new ssh or it's warning you of the possiblity, that there is a 'third part'. ( called 'man in the middle attack')

check link below if interested. https://en.wikipedia.org/wiki/Man-in-the-middle_attack

Hope this makes things a bit more clear.

1
  • 1
    +1 Yes, this is a "I've never seen this identity before" alert - and you've hit the nail on the head - it's to be expected for a first connection but if it pops up for one you've used before, it could be a MITM attack. – SlySven Dec 31 '15 at 19:09
1

This is normal part of the SSH protocol, it is a security feature. The first time you connect to a new server you won't have a stored key for the server. Because the key does not exist in the known servers list, so it is asking you whether to trust the remote machine or not. if you answer no you won't be able to connect. If you accept the key, it will be stored and you won't normally see the message again - if you do either the server's key has changed or it indicates malicious activity and you should investigate further. You can read more about the key fingerprint and how to verify it here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.