I'm using a web hosting service that offers both FTP and SSH access, but for SSH they only allow authentication via SSH keys. I've generated myself SSH keys using ssh-keygen, imported them into my Ubuntu system using ssh-add, and uploaded the key to my hosting service's web control panel. My ~/.ssh/config file contains this:
Host myhostname
Hostname ssh.myhostname.com
User myhostname
PubKeyAuthentication yes
IdentityFile /home/aaronfranke/.ssh/id_rsa
The host name and username are the same, but I've replaced the name with "myhostname" for all the config/terminal snips. The first time I connect in the terminal, I get permission denied (publickey):
$ ssh myhostname
The authenticity of host 'ssh.myhostname.com (23.217.138.110)' can't be established.
ECDSA key fingerprint is SHA256:6MJJtqKhTdHXF2yzH/0UqGN2o4RZ2PDEp2ttdA/IJR8.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'ssh.myhostname.com' (ECDSA) to the list of known hosts.
myhostname@ssh.myhostname.com: Permission denied (publickey).
Immediately afterwards, if I try to reconnect, I get an error that the ECDSA host key has changed:
$ ssh myhostname
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The ECDSA host key for ssh.myhostname.com has changed,
and the key for the corresponding IP address 23.202.231.169
is unchanged. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
Offending key for IP in /home/aaronfranke/.ssh/known_hosts:1
remove with:
ssh-keygen -f "/home/aaronfranke/.ssh/known_hosts" -R "23.202.231.169"
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:HnzBy7BAfkMCT4uIcdLrpoWiOrnhHhN8k7XMbbB2Epk.
Please contact your system administrator.
Add correct host key in /home/aaronfranke/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /home/aaronfranke/.ssh/known_hosts:3
remove with:
ssh-keygen -f "/home/aaronfranke/.ssh/known_hosts" -R "ssh.myhostname.com"
ECDSA host key for ssh.myhostname.com has changed and you have requested strict checking.
Host key verification failed.
I can do as suggested and remove the key from the list of known hosts...
$ ssh-keygen -f "/home/aaronfranke/.ssh/known_hosts" -R "ssh.myhostname.com"
# Host ssh.myhostname.com found: line 3
/home/aaronfranke/.ssh/known_hosts updated.
Original contents retained as /home/aaronfranke/.ssh/known_hosts.old
...but if I reconnect, I get the same message above as the first time I connect, and then again the same message about the host key changing. The exact same thing happens if I run rm ~/.ssh/known_hosts.
What's weird is that these messages are the exact same. Every time, if the host is not in my known_hosts file, the server fingerprint is SHA256:6MJJtqKhTdHXF2yzH/0UqGN2o4RZ2PDEp2ttdA/IJR8, and every time the host is known, the server fingerprint is SHA256:HnzBy7BAfkMCT4uIcdLrpoWiOrnhHhN8k7XMbbB2Epk
Why would the fingerprint change depending on if the host is known or not? How can I stop the fingerprint from changing? Is there something wrong with my client or with the server?
Is there a way that I can manually insert the host fingerprint provided by the 2nd connect attempt into my known_hosts file? Is there a way I can authorize both fingerprints?
