<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>ardlian.net &#187; ssh rsa man-in-the-middle attack</title>
	<atom:link href="http://ardlian.net/tag/ssh-rsa-man-in-the-middle-attack/feed/" rel="self" type="application/rss+xml" />
	<link>http://ardlian.net</link>
	<description>just another think of me</description>
	<lastBuildDate>Wed, 11 Aug 2010 15:29:09 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @</title>
		<link>http://ardlian.net/2008/07/warning-remote-host-identification-has-changed/</link>
		<comments>http://ardlian.net/2008/07/warning-remote-host-identification-has-changed/#comments</comments>
		<pubDate>Wed, 23 Jul 2008 05:41:31 +0000</pubDate>
		<dc:creator>ardlian</dc:creator>
				<category><![CDATA[Linux]]></category>
		<category><![CDATA[ssh rsa man-in-the-middle attack]]></category>

		<guid isPermaLink="false">http://ardlian.wordpress.com/?p=85</guid>
		<description><![CDATA[Ardlian@the-dark:~$ ssh ardlixx@222.xxx.xxx.xxx
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
47:13:a0:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Please contact your system administrator.
Add correct [...]]]></description>
			<content:encoded><![CDATA[<blockquote><p>Ardlian@the-dark:~$ ssh ardlixx@222.xxx.xxx.xxx<br />
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@<br />
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @<br />
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@<br />
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!<br />
Someone could be eavesdropping on you right now (man-in-the-middle attack)!<br />
It is also possible that the RSA host key has just been changed.<br />
The fingerprint for the RSA key sent by the remote host is<br />
47:13:a0:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.<br />
Please contact your system administrator.<br />
Add correct host key in /home/ardlian/.ssh/known_hosts to get rid of this message.<br />
Offending key in /home/ardlian/.ssh/known_hosts:5<br />
RSA host key for 222.xxx.xxx.xx has changed and you have requested strict checking.<br />
Host key verification failed.</p></blockquote>
<p>biasa.. baru newbie menghadapi pesan seperti di atas jadi bingung&#8230; wke&#8230; setelah kontak sama server adminnya dan ternyata tidadk ada perubahan RSA key, gedubrak.. jadi tambbah bingung..</p>
<p>Tapi th3c0d3 pada dasarnya adalah orang yang cerdas, dia berpikir selama ada google semua bisa diatasi wke.. wke&#8230; dia dapa link <a href="http://www.cyberciti.biz/faq/warning-remote-host-identification-has-changed-error-and-solution/" target="_self">ini</a> . Oke pada intinya dari artikel dari link tersebut ada dua solusi,</p>
<p><strong>Solusi 1</strong></p>
<p><em>Jika SSH server kita cuma 1&lt;Tinggal delet aja file known_hosts&gt;<br />
</em></p>
<p>Maka langkah yang di ambil adalah :</p>
<blockquote><p><code>rm .ssh/known_hosts<br />
ssh ras.mydomain.com</code></p></blockquote>
<p><strong>Solusi 2</strong></p>
<p><em>Jika SSH server kita lebih dari atu &lt;tingal delet aja rsa key server tersebut&gt;</em></p>
<p>1. Edit file known_hosts</p>
<blockquote><p><code>vi +2 .ssh/known_hosts </code></p></blockquote>
<p>2. Delet baris yang menunjukan rsa server  222.1xx.xxx.xx, kasus di atas adalah rsa yang kelima di tunjukkan oleh pesan erro &#8220;<em>Offending key in /home/ardlian/.ssh/known_hosts:5</em>&#8220;. untuk delet baris ketikkan command</p>
<blockquote><p>dd</p></blockquote>
<p>3. Kemudian save dan exit dengan command</p>
<blockquote><p>:wq</p></blockquote>
<p>coba login dengan SSh lagi, Jika berhasil maka</p>
<blockquote><p>ardlian@the-dark:~$ ssh sixxxx@222.xxx.xxx.xxx<br />
The authenticity of host &#8216;222.xxx.xxx.xxx (222.xxx.xxx.xxx)&#8217; can&#8217;t be established.<br />
RSA key fingerprint is 47:13:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.<br />
Are you sure you want to continue connecting (yes/no)? yes<br />
Warning: Permanently added &#8216;222.xxx.xxx.xxx&#8217; (RSA) to the list of known hosts.<br />
Password:<br />
Last login: Tue Jul 22 16:18:39 2008 from 222.xxx.xxx.xxx<br />
sixxxx@portxxxx:~&gt;</p></blockquote>
<p>Just For newbie</p>
<p>===========================================================================</p>
<p>Hal di atas disebabkan karena saat pertama kali th3c0d3 connect ssh server 222.xxx.xxx.xxx menggunakan IP yang berbeda dengan saat dia mendapatkan WARNING dari the-dark</p>
<p>===========================================================================</p>
<p>ref:</p>
<p>http://www.cyberciti.biz/faq/warning-remote-host-identification-has-changed-error-and-solution/</p>
<p><a class="a2a_dd addtoany_share_save" href="http://www.addtoany.com/share_save"><img src="http://ardlian.net/wp-content/plugins/add-to-any/share_save_171_16.png" width="171" height="16" alt="Share/Bookmark"/></a> </p>]]></content:encoded>
			<wfw:commentRss>http://ardlian.net/2008/07/warning-remote-host-identification-has-changed/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
	</channel>
</rss>
