Nope, nothing nasty! That happened after Ops restarted the bastion host https://lists.wikimedia.org/pipermail/wikitech-l/2016-April/085289.html. Instructions are at that link, but the key fingerprints are outdated. The new ones are on Phabricator https://phabricator.wikimedia.org/T123721#2204676.

On Mon, Apr 18, 2016 at 5:11 PM, Jon Katz jkatz@wikimedia.org wrote:

Hey Folks, I am suddenly having trouble logging into stat1002 or stat1003 using my normal settings. Here is what I get:

*Jon-Katzs-Air:~ jkatz$ ssh jkatz@stat1003.eqiad.wmnet*

*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@*

*@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @*

*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@*

*IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!*

*Someone could be eavesdropping on you right now (man-in-the-middle attack)!*

*It is also possible that a host key has just been changed.*

*The fingerprint for the RSA key sent by the remote host is*

*[REDACTED BY JK].*

*Please contact your system administrator.*

*Add correct host key in /Users/jkatz/.ssh/known_hosts to get rid of this message.*

*Offending RSA key in /Users/jkatz/.ssh/known_hosts:1*

*RSA host key for bast1001.wikimedia.org http://bast1001.wikimedia.org has changed and you have requested strict checking.*

*Host key verification failed.*

*ssh_exchange_identification: Connection closed by remote host*

Here is my host.config file:

*ForwardAgent no*

*Host !bast1001.wikimedia.org http://bast1001.wikimedia.org *.wikimedia.org http://wikimedia.org *.wmnet*

• ProxyCommand ssh -a -W %h:%p bast1001.wikimedia.org
  

http://bast1001.wikimedia.org*

Is someone doing something nasty?

Any ideas?

Thanks,

J

---

Analytics mailing list Analytics@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/analytics

Thanks, Neil and Dan! That worked like a charm. -J

On Mon, Apr 18, 2016 at 5:20 PM, Dan Garry dgarry@wikimedia.org wrote:

Hey Jon,

In this case, everything is fine. bast1001 underwent some maintenance recently and its keys changed; take a look at the ops mailing list for more details. You can use something like this command (if you're on a Mac) to remove the old keys:

ssh-keygen -f "/Users/yourusername/.ssh/known_hosts" -R bast1001 .wikimedia.org

Dan

On 18 April 2016 at 17:11, Jon Katz jkatz@wikimedia.org wrote:

...

Hey Folks, I am suddenly having trouble logging into stat1002 or stat1003 using my normal settings. Here is what I get:

*Jon-Katzs-Air:~ jkatz$ ssh jkatz@stat1003.eqiad.wmnet*

*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@*

*@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @*

*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@*

*IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!*

*Someone could be eavesdropping on you right now (man-in-the-middle attack)!*

*It is also possible that a host key has just been changed.*

*The fingerprint for the RSA key sent by the remote host is*

*[REDACTED BY JK].*

*Please contact your system administrator.*

*Add correct host key in /Users/jkatz/.ssh/known_hosts to get rid of this message.*

*Offending RSA key in /Users/jkatz/.ssh/known_hosts:1*

*RSA host key for bast1001.wikimedia.org http://bast1001.wikimedia.org has changed and you have requested strict checking.*

*Host key verification failed.*

*ssh_exchange_identification: Connection closed by remote host*

Here is my host.config file:

*ForwardAgent no*

*Host !bast1001.wikimedia.org http://bast1001.wikimedia.org *.wikimedia.org http://wikimedia.org *.wmnet*

• ProxyCommand ssh -a -W %h:%p bast1001.wikimedia.org
  

http://bast1001.wikimedia.org*

Is someone doing something nasty?

Any ideas?

Thanks,

J

---

Analytics mailing list Analytics@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/analytics

-- Dan Garry Lead Product Manager, Discovery Wikimedia Foundation

---

Analytics mailing list Analytics@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/analytics