Host Keys heart attack

Posted: 30 March, 2023 Category: backend Tagged: githubssh

Putting aside for a moment that this page could've hosed my ssh config file, because mine is hashed or whatever and so no, I don't think I can just crack it open and type whatever I want into it? At least not without some other commands?

Anyway. When you're in the middle of github handshakes and then this suddenly gets flung across your terminal:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.

It's... a little unnerving. For those not in the know: recently, newbs insufficiently aquainted with ssh edge cases could be heard mewling in despair across the interwebs when github saw fit to rotate their host keys. Thankfully a smattering of stackexchange/github-thread good samaritans came to blot away our tears and cradle us to their linux-y bossoms. It amounted to the issue of known hosts, and github no longer being recognized as one. Honestly would've been best if that error message had led with the 4th line, and ramped up from there. Lol!

Removing problematic hosts can be done either by hostname or host ip, thusly:

ssh-keygen -R github.com # and, actually, critically, for **EVERY** **SINGLE** IP it will ever go on to complain about.

Note the pseudo-comment: One solitary IP for github.com was always unlikely, so there was a bunch of IPs to clean out. Had to fix and fix again, until the complaints stopped.