Self-Solve Knowledge Search

Minimize Maximize
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED
This document has not been formally reviewed for accuracy and is provided as is
Title :
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED
Document ID :
KM02118004
Product - Version:
arcsight connector appliance 6.4 ; arcsight smart connectors 7.0 ;
OS :
Updated :
Mon Feb 01 18:07:37 GMT 2016
Summary :
We are trying to SCP logs from an Ironport device to our smart connector and cannot figure out what we are doing wrong. error from the connapp Jan 4 14:15:50 arcsight-connector sshd[53046]: Connection closed by 10.9.60.215 [preauth] Error from Iron Port Log Error: Push error for subscription accesslogs_arcsight: SCP failed to transfer to arcsight-connector.diebold.com:22: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The RSAfingerprint for the key sent by the remote host is 1b:d0:2b:0e:8a:e8:17:8a:b8:50:24:a1:53:b1:96:49. Please contact your system administrator. Add correct host key in /root/.ssh/known_hosts to get rid of this message. Offending RSA key in /root/.ssh/known_hosts:1 RSA host key for arcsight-connector.diebold.com has changed and you have requested strict checking. Host key verification failed. lost connection
Problem

Log Error: Push error for subscription accesslogs_arcsight: SCP failed to transfer to arcsight-connector.diebold.com:22: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The RSAfingerprint for the key sent by the remote host is 1b:d0:2b:0e:8a:e8:17:8a:b8:50:24:a1:53:b1:96:49. Please contact your system administrator. Add correct host key in /root/.ssh/known_hosts to get rid of this message. Offending RSA key in /root/.ssh/known_hosts:1 RSA host key for arcsight-connector.diebold.com has changed and you have requested strict checking. Host key verification failed. lost connection

Cause
This can happen because the ID for your hostname is not what your client expected. This can happen if you rebuilt your droplet from scratch, or if you recently pointed your hostname to a different server.
Fix

You can just delete the line that have your current IP in the known_hosts file, you can find it here:

/home/username/.ssh/known_hosts

Or you can use this commands to modify this file:

ssh-keygen -R [HOSTNAME]

ssh-keygen -R [IP_ADDRESS]

Is good to verify if the account that you are using have root access.