Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I was sshing into my iPhone, and I added an app from my computer. Then I switched computers and was going to fix something in it, and it gave me a semi-disconcerting error message...

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.

What exactly has just happened, and why?

share|improve this question
2  
No idea, but if you are worried, I suggest changing your SSH password, and reboting for a start. Then come back ;) You weren't using the default "Alpine" password were you? –  stuffe Mar 26 '12 at 14:03
    
@stuffe I was... Do you suggest changing it? –  CoffeeRain Mar 26 '12 at 14:04
2  
Put it this way, if I knew your root password, so did the entire internet. So, yeah, change it and reboot to make sure anyone else that may have logged in is at least kicked out. –  stuffe Mar 26 '12 at 14:06
2  
To be honest, I am at the limit of my jailbreak knowledge, but I expect there are a load of guides on the internet, and I don't want to fill your comments up with guesswork. Hopefully one of our resident Jailbreak guys will be around soon to answer properly :) –  stuffe Mar 26 '12 at 14:17
1  
@CoffeeRain Yes, use su, then type in "alpine", and then use the passwd command. –  Andrew Larsson Mar 26 '12 at 17:25

1 Answer 1

up vote 2 down vote accepted

The ssh tool stores known remote computer IP address and remote ssh key identification in the ~/.ssh directory.

You can read up on this by consulting the manual page on your mac man ssh or on the internet.

You may need to read the entire article and do some follow up research if this is your first exposure with ssh - but the relevant section for the warning you pasted goes thusly:

ssh automatically maintains and checks a database containing identification for all hosts it has ever
     been used with.  Host keys are stored in ~/.ssh/known_hosts in the user's home directory.  Addition-
     ally, the file /etc/ssh_known_hosts is automatically checked for known hosts.  Any new hosts are auto-
     matically added to the user's file.  If a host's identification ever changes, ssh warns about this and
     disables password authentication to prevent server spoofing or man-in-the-middle attacks, which could
     otherwise be used to circumvent the encryption.

In essence - either the key changed, the host name changed or the IP address changed and ssh is warning you that one or more of these do not match. You can turn off the storing, the warning or clear the cache if you don't care to investigate more. This is a very useful tool for people that ssh into fixed servers and need to know when things like the above change.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.