can't write to ssh known_hosts file

Question

can't write to ssh known_hosts file

Awhile back I did a complete restore from backup of an MBP. Since then this machine's ssh client can no longer will write to the ~/.ssh/known_hosts file:

The authenticity of host 'dhcp167 (172.31.0.167)' can't be established.
DSA key fingerprint is 66:3d:0c:31:e0:07:09:6b:21:f9:8c:79:40:50:01:45.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/Users/dnewman/.ssh/known_hosts).

I have write access to this file:

dhcp130:~ dnewman$ ls -l /Users/dnewman/.ssh/known_hosts
-rw-r--r--@ 1 dnewman staff 36439 Sep 26 17:51 /Users/dnewman/.ssh/known_hosts

How to remedy this error?

thanks

MacBook Pro, Mac OS X (10.5.6)

Posted on Dec 18, 2008 9:47 AM

Reply

Answer 1

Dec 18, 2008 10:09 AM in response to David Newman5

from looking at mine, it doesn't need to be world readable.
and it looks like you've got some acl set too.

the following will correct it.

chmod 600 /Users/dnewman/.ssh/known_hosts

Reply

Answer 2

Dec 18, 2008 10:23 AM in response to Nils C. Anderson

Thanks, that file shouldn't have been world readable -- but that did not solve the problem either.

I did the restore because some OS files were corrupted. I did not use the migration assistant in doing so, but rather did a clean install of the OS and then restored my data files (including ~/.ssh/*) from backup. I'm not an ssh guru but I wonder if there's some disconnect between the contents of ~/ssh and the MBP's current system keys (which are different than the pre-restore keys)?

thaks again

Reply

Answer 3

BobHarris

Level 9

56,927 points

Dec 18, 2008 1:16 PM in response to David Newman5

With respect to permissions, you should look at *man ssh* and search for permissions. There are several ssh files that need to have restrictive ownership and permissions, however, generally if they are bad permissions, ssh will refuse to make the connection if it can not trust its configuration files.

Have you tried using


ssh -v -v -v remote.host.addr

and seeing if the additional debugging information throws more light on the problem?

You might even consider comparing the -v -v -v output from a Good connection with the Failed connection. The differences might point out something useful.

Reply

Answer 4

Dec 18, 2008 2:57 PM in response to BobHarris

Sorry I didn't make this clearer, but I am able to connect with ssh.

What I am not able to do is save the remote system's public key to ~/.ssh/known_hosts, even though I have write permission to the file:

$ ls -l ~/.ssh/known_hosts
-rw-------@ 1 dnewman staff 36439 Sep 26 17:51 /Users/dnewman/.ssh/known_hosts

As a result I get the same unknown-host prompt every time I ssh to each host:

dhcp130:Desktop dnewman$ ssh -l root dhcp167
The authenticity of host 'dhcp167 (172.31.0.167)' can't be established.
DSA key fingerprint is 66:3d:0c:31:e0:07:09:6b:21:f9:8c:79:40:50:01:45.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/Users/dnewman/.ssh/known_hosts).

(and then it goes on to connect)

My question is how to restore the ability to write to known_hosts.

thanks

Reply

Answer 5

Dec 18, 2008 3:36 PM in response to David Newman5

Can you manually edit the file? Make a back up first.

What do the permission for path leading to the file look like?

ls -ld /{,Users/{,dnewman/{,.ssh}}}

What are the extended attributes, indicated by the '@' appended to the mode bits?
I'm wondering if they might be interfering with ssh being able to write to the file.

You can list them using

ls -ld@ <filename>

Message was edited by: Nils C. Anderson

Reply

Answer 6

Dec 18, 2008 4:06 PM in response to Nils C. Anderson

Can you manually edit the file?

No. vi thinks it's a readonly file despite the 0600 perms

What do the permission for path leading to the file look like?

dhcp130:.ssh dnewman$ ls -ld /{,Users/{,dnewman/{,.ssh}}}
drwxr-xr-x 36 root admin 1292 Dec 15 16:07 /
drwxr-xr-x 5 root admin 170 Oct 21 07:50 /Users/
drwxr-xr-x+ 39 dnewman staff 1326 Dec 18 15:56 /Users/dnewman/
drwx------@ 6 dnewman staff 204 Sep 20 12:22 /Users/dnewman/.ssh

dhcp130:.ssh dnewman$ ls -ld@ known_hosts
-rw-------@ 1 dnewman staff 36439 Sep 26 17:51 known_hosts
com.apple.metadata:_kTimeMachineNewestSnapshot 50
com.apple.metadata:_kTimeMachineOldestSnapshot 50

The permissions thing is interesting. Is the problem that I had a different UID or GID on the "old" machine image (the one I restored from) than what's currently running? And if so, how to remedy?

thanks much!

Reply

Answer 7

Dec 18, 2008 4:33 PM in response to Nils C. Anderson

The only place that I find this message in the source code.
from: sshconnect.c


 827 if (!r)
 828 logit("Failed to add the host to the list of known "
 829 "hosts (%.500s).", user_hostfile);

[sshconnect.c|http://www.opensource.apple.com/darwinsource/10.5.6/OpenSSH-95.1.5 /openssh/sshconnect.c]

The function that is unable to access the file is

add host_tohostfile

in the file [hostfile.c|http://www.opensource.apple.com/darwinsource/10.5.6/OpenSSH-95.1.5/ openssh/hostfile.c]

So checked to see if you can append information to the file. Make a backup of the file first.

Message was edited by: Nils C. Anderson

Reply

Answer 8

Dec 18, 2008 4:34 PM in response to David Newman5

What does the 'id' command return?

Reply

Answer 9

Dec 18, 2008 4:39 PM in response to Nils C. Anderson

can't append to known_hosts -- permission denied. Same deal when trying to write changes using vi.

id returns the following:

uid=0(root) gid=0(wheel) groups=0(wheel),1(daemon),8(procview),2(kmem),29(certusers),3(sys),9(procmod),4 (tty),101(com.apple.sharepoint.group.1),5(operator),80(admin),20(staff)

I suspect a UID or GID on the restore image was different than the what's posted above, but not sure where.

thanks!

Reply

Answer 10

Dec 18, 2008 6:41 PM in response to David Newman5

I tried changing the permissions on my system to match those that you
reported above. I was still able to append new entries to the ~/.ssh/known_hosts
file.

scratching head now. from the looks of it uid/gid should be the same. based
on your initial entry.

What does

ls -ld@ /Users/dnewman/

return?

Reply

Answer 11

Dec 18, 2008 6:55 PM in response to Nils C. Anderson

Nils C. Anderson wrote:
What does

ls -ld@ /Users/dnewman/

return?

dhcp130:~ dnewman$ ls -ld@ /Users/dnewman/
drwxr-xr-x+ 40 dnewman staff 1360 Dec 18 16:36 /Users/dnewman/

dhcp130:~ dnewman$ ls -ld@ /Users/dnewman/.ssh
drwx------@ 6 dnewman staff 204 Sep 20 12:22 /Users/dnewman/.ssh
com.apple.metadata:_kTimeMachineNewestSnapshot 50
com.apple.metadata:_kTimeMachineOldestSnapshot 50

Reply

Answer 12

Dec 19, 2008 4:44 AM in response to David Newman5

What acl's are set on the directory? the '-e' option to 'ls' should give us this.

ls -ldeo /Users/dnewman/

Reply

Answer 13

Dec 19, 2008 7:30 AM in response to Nils C. Anderson

Nils C. Anderson wrote:
What acl's are set on the directory? the '-e' option to 'ls' should give us this.

ls -ldeo /Users/dnewman/

dhcp130:~ dnewman$ ls -ldeo /Users/dnewman/
drwxr-xr-x+ 40 dnewman staff - 1360 Dec 18 16:36 /Users/dnewman/
0: group:everyone deny delete

So far, so good. But then there's this:

dhcp130:~ dnewman$ ls -ldeo /Users/dnewman/.ssh
drwx------@ 6 dnewman staff - 204 Sep 20 12:22 /Users/dnewman/.ssh
0: group:everyone deny add file,delete,add_subdirectory,deletechild,writeattr,writeextattr,chown

curiouser and curiouser...

Reply

Answer 14

Dec 19, 2008 3:35 PM in response to David Newman5

from looking over the chmod(1) to remove the acl


chmod -a# 0 /Users/dnewman/.ssh

Reply

Answer 15

Dec 19, 2008 9:32 PM in response to Nils C. Anderson

Nils C. Anderson wrote:
from looking over the chmod(1) to remove the acl
chmod -a# 0 /Users/dnewman/.ssh

Success! I had to run this command on both the directory and all the files in the directory but I'm now able to write to known_hosts.

There are now no access rules in effect on the ~/.ssh directory or its contents. Should there be, and if so how to apply them? I can't tell from the chmod(1) manpage.

thanks very much!

Reply