WARNING: POSSIBLE DNS SPOOFING DETECTED!

WARNING: POSSIBLE DNS SPOOFING DETECTED!

1 문제상황

root@zetadb:~# ssh zetawiki
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The ECDSA host key for zetawiki has changed,
and the key for the corresponding IP address 135.79.246.80
is unknown. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
ac:e1:35:b7:df:92:c4:6e:8a:d0:35:fb:79:14:68:ea.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /root/.ssh/known_hosts:1
  remove with: ssh-keygen -f "/root/.ssh/known_hosts" -R zetawiki
ECDSA host key for zetawiki has changed and you have requested strict checking.
Host key verification failed.

2 원인

• zetawiki 서버를 교체함 (IP도 바뀌고, host key도 바뀜)
• 단, 별다른 변경이 없었는데 이러한 메시지가 나오면 진짜 DNS 스푸핑을 의심해봐야 함

root@zetadb:~# cat /etc/hosts | grep zetawiki
135.79.246.80	zetawiki

→ 현재 IP는 135.79.246.80이지만, 예전에는 다른 IP였음

3 해결방법

• (주의!) 변경작업 때문에 저러한 메시지가 발생한 것이 아니라면 이러한 방법으로 해결해서는 안됨

root@zetadb:~# ssh-keygen -f ~/.ssh/known_hosts -R zetawiki
/root/.ssh/known_hosts updated.
Original contents retained as /root/.ssh/known_hosts.old

root@zetadb:~# ssh zetawiki
The authenticity of host 'zetawiki (135.79.246.80)' can't be established.
ECDSA key fingerprint is ac:e1:35:b7:df:92:c4:6e:8a:d0:35:fb:79:14:68:ea.
Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added 'zetawiki,135.79.246.80' (ECDSA) to the list of known hosts.
root@zetawiki's password:

4 같이 보기

• DNS 스푸핑
• ECDSA
• WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
• WARNING: UNPROTECTED PRIVATE KEY FILE!

5 참고

• https://support.cloud.engineyard.com/hc/en-us/articles/205404668-Warning-message-DNS-SPOOFING-DETECTED-when-SSHing-into-instances