Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

warning: possible dns spoofing detected!

Im trying to connect to my university's server using SSH on Terminal from home (outside the uni networks). Im getting the following:

My-Computer:~ mycomputer$ ssh username@hostaddress.ac.uk
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key hostaddress.ac.uk has changed,
and the key for the according IP address 146.176.restofip.here
is unknown. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
8a:0b:63:5b:43:64restofhexhere3e:78.
Please contact your system administrator.
Add correct host key in /Users/mycomputer/.ssh/known_hosts to get rid of this message.
Offending key in /Users/mycomputer/.ssh/known_hosts:1
RSA host key hostaddress.ac.uk has changed and you have requested strict checking.
Host key verification failed.
My -Computer:~ mycomputer$

Im on a cable connection at home using a linksys wireless router, on OSX 10.4.10.

Quite concerned about the DNS spoofing and man-in-the-middle attack. Is this a problem at my end rather than the universities? From the error message I gather that its something to do with my security settings and me missing a key somewhere...not too sure what this means tho.

I tried speaking with C&IT at my university, but I got the 'no idea about macs sorry cant help'.

Any ideas?

Powerbook G4, Mac OS X (10.4.1), 15"

Posted on Nov 19, 2007 8:22 AM

Reply
Question marked as Best reply

Posted on Nov 19, 2007 9:25 AM

B Real wrote:
It is also possible that the RSA host key has just been changed.


When they say "it is also possible", they mean "it is 99.99987% likely that".

What is happening is that you ask for "hostaddress.ac.uk" and your Mac resolves that to 146.176.restofip.here and then your Mac looks up 146.176.restofip.here and gets "cluelessadmin.ac.uk" and complains.

Luckily, ssh also tells you how to fix it..

Add correct host key in /Users/mycomputer/.ssh/known_hosts to get rid of this message.
4 replies
Question marked as Best reply

Nov 19, 2007 9:25 AM in response to B Real

B Real wrote:
It is also possible that the RSA host key has just been changed.


When they say "it is also possible", they mean "it is 99.99987% likely that".

What is happening is that you ask for "hostaddress.ac.uk" and your Mac resolves that to 146.176.restofip.here and then your Mac looks up 146.176.restofip.here and gets "cluelessadmin.ac.uk" and complains.

Luckily, ssh also tells you how to fix it..

Add correct host key in /Users/mycomputer/.ssh/known_hosts to get rid of this message.

Nov 19, 2007 9:55 AM in response to etresoft

etresoft wrote:

When they say "it is also possible", they mean "it is 99.99987% likely that".


Thank god!

Luckily, ssh also tells you how to fix it..

Add correct host key in /Users/mycomputer/.ssh/known_hosts to get rid of this message.


I presume my goal then is to add the fingerprint for the RSA key sent by the remote host, i.e. 8a:0b:63:5b:43:64restofhexhere3e:78, to the file known_hosts in the directory /Users/mycomputer/.ssh/

How do I do this? Something like:

$ export /Users/mycomputer/.ssh/known_hosts = ${/Users/mycomputer/.ssh/known_hosts}:63:5b:43:64restofhexhere3e:78

As you can imagine, im not overly comfortable with manipulating files using terminal... but willing to give it a go and keen to learn.

Nov 19, 2007 11:54 AM in response to B Real

You just have to remove that line in the known_hosts file. I think it is on line 1. It starts with the host name. If you aren't that comfortable with the terminal, you can just delete the known_hosts file. The next time you connect to anything via ssh, it will ask if it should add the host to your known_hosts file. At that point, the file will have been successfully re-created.

warning: possible dns spoofing detected!

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.