-
Title
Error: "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" -
Description
When attempting to do a "Test System" on a system, or a "Check Password" / "Reset Password" on an account, the following messages appear in the logs:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!Someone could be eavesdropping on you right now (man-in-the-middle attack)!It is also possible that the RSA host key has just been changed.The fingerprint for the RSA key sent by the remote host is82:ab:80:aa:3d:d6:f9:da:64:00:42:9b:bb:e3:22:b5.Please contact your system administrator.Add correct host key in /home/Administrator/.ssh/known_hosts to get rid of this message.Offending key in /home/Administrator/.ssh/known_hosts:11Password authentication is disabled to avoid man-in-the-middle attacks.Keyboard-interactive authentication is disabled to avoid man-in-the-middle attacks.debug1: ssh_rsa_verify: signature correctdebug1: SSH2_MSG_NEWKEYS sentdebug1: expecting SSH2_MSG_NEWKEYSdebug1: SSH2_MSG_NEWKEYS receiveddebug1: SSH2_MSG_SERVICE_REQUEST sentdebug1: SSH2_MSG_SERVICE_ACCEPT receiveddebug1: Authentications that can continue: publickey,gssapi-with-mic,passworddebug1: No more authentication methods to try.Permission denied (publickey,gssapi-with-mic,password).Unable to connect to the remote system, permission deniedUnable to connect to managed.yourdomain.com, or the account funcacct does not exist or is disabled.
This is seen on target systems that use SSH such as Cisco, Juniper Linux, or Unix. -
Cause
When TPAM connects to a SSH server, it records a fingerprint of the targets host key in a known_hosts file. If on a later connection, the key sent by the server does not match TPAMs record, the man in the middle (MITM) warning is shown and password authentication is prevented.The issue occurs if the target system host keys have been changed, possible reasons are:
1. The public keys on the server changed. This could be due to the OS being reinstalled, SSH reinstalled/update, or from keyssh-keygen being ran.
2. The servers hostname /IP address have changed, and used to belong to a different server (thus a has a different host key) -
Resolution
Perform the following steps to remove the host entry from TPAMs known_hosts file:
Navigate to /tpam | Systems | Manage Systems | Select the target server showing this message | Details Tab | Click the "Clear Sys. Host Entry" button.
If this error persists after the above, navigate to the /admin interface | Keys | Manage Host Keys, and look for the system in the listing by both name and IP address, and select "Clear Known Host" on any records.
If using DPA, from the "Affinity" tab toggle the setting between "Use local PPM appliance for password checks and changes" and "Selected DPA affinity" | Save Changes | "Clear Sys. Host Entry" then retoggle the setting back to ensure the host entries are removed from both the DPA(s) and TPAM.