Re: ssh fingerprint mismatch for one single client

From	Fabien Roucaute <fabien.roucaute@free.fr>
Newsgroups	linux.debian.user
Subject	Re: ssh fingerprint mismatch for one single client
Date	2020-09-20 20:40 +0200
Message-ID	<ARcpH-2Lz-1@gated-at.bofh.it> (permalink)
References	<AQSAF-7LQ-1@gated-at.bofh.it> <AR3cJ-5He-3@gated-at.bofh.it> <AR3cJ-5He-1@gated-at.bofh.it> <ARb0B-23S-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Le 20/09/2020 à 18:59, Beco a écrit :

> I mean the numbers are completely different.
> PUTTY: not only different, but it appears to get a ED25519 which is not
> on the server.
> SSH powershell: It gets ECDSA, which is the algorithm accepted, but a
> completely different hex code.
> 
> If I run on my notebook the command:
> My answer is OK
> 
> $ nmap -p22 -n --script ssh-hostkey the.server.in.question
> Starting Nmap 7.70 ( https://nmap.org ) at 2020-09-19 19:12 -03
> Nmap scan report for the.server.in.question (198.200.100.50)
> Host is up (0.0055s latency).
> PORT   STATE SERVICE
> 22/tcp open  ssh
> | ssh-hostkey:
> |   2048 33:44:55:66:77:88:99:11:22:33:44:55:66:77:aa:bb (RSA)
> |   256 cc:99:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee (ECDSA)
> Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds
> 
> My notebook (external) shows correct server IP and the 2 accepted
> fingerprints.
> 
> 
> 
> On Bob's notebook:
> 
> $ nmap -p22 -n --script ssh-hostkey the.server.in.question
> Starting Nmap 7.70 ( https://nmap.org ) at 2020-09-19 18:12 -03
> Nmap scan report for the.server.in.question (198.200.100.50)
> Host is up (0.0055s latency).
> PORT   STATE SERVICE
> 22/tcp open  ssh
> | ssh-hostkey:
> |   2048 12:34:56:78:9c:cd:dc:cd:de:ef:f0:01:12:13:14:15 (RSA)
> |   256 5b:6b:4b:3b:2b:1b:8b:2b:7b:9b:9b:0b:3b:5b:4b:3b (ECDSA)
> |_  256 a1:a2:a3:a4:a5:a6:a7:a8:a9:a0:a1:a2:a3:a4:a5:a6 (ED25519)
> Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds
> 
> All wrong.
>

Very strange, could be a router in your network that NAT  his connection
to the wrong server. Have you tried to scan other servers in your
network to look for the same fingerprints?
I can't see how he can get back answering packets with the right IP but
not the right fingerprint if a network device wasn't changing the IP
somewhere on the route between him and the server.

Thread

ssh fingerprint mismatch for one single client Beco <rcb@beco.cc> - 2020-09-19 23:30 +0200
  Re: ssh fingerprint mismatch for one single client Lucas Castro <lucas@gnuabordo.com.br> - 2020-09-19 23:50 +0200
    Re: ssh fingerprint mismatch for one single client Beco <rcb@beco.cc> - 2020-09-20 00:40 +0200
  Re: ssh fingerprint mismatch for one single client mick crane <mick.crane@gmail.com> - 2020-09-20 00:00 +0200
    Re: ssh fingerprint mismatch for one single client Beco <rcb@beco.cc> - 2020-09-20 00:50 +0200
      Re: ssh fingerprint mismatch for one single client mick crane <mick.crane@gmail.com> - 2020-09-20 05:40 +0200
      Re: ssh fingerprint mismatch for one single client David Christensen <dpchrist@holgerdanske.com> - 2020-09-20 08:00 +0200
  Re: ssh fingerprint mismatch for one single client Reco <recoverym4n@enotuniq.net> - 2020-09-20 10:50 +0200
    Re: ssh fingerprint mismatch for one single client Beco <rcb@beco.cc> - 2020-09-20 19:10 +0200
      Re: ssh fingerprint mismatch for one single client Beco <rcb@beco.cc> - 2020-09-20 19:20 +0200
      Re: ssh fingerprint mismatch for one single client Reco <recoverym4n@enotuniq.net> - 2020-09-20 19:30 +0200
      Re: ssh fingerprint mismatch for one single client Fabien Roucaute <fabien.roucaute@free.fr> - 2020-09-20 20:40 +0200
      Re: ssh fingerprint mismatch for one single client tomas@tuxteam.de - 2020-09-21 09:20 +0200
        (solved) Re: ssh fingerprint mismatch for one single client Beco <rcb@beco.cc> - 2020-09-23 02:00 +0200
  Re: ssh fingerprint mismatch for one single client <tomas@tuxteam.de> - 2020-09-20 10:50 +0200

csiph-web