Re: OpenSSH Assistance - New Admin

Günther Schwarz <strap@xxxxxx> writes:

Joe Pfeiffer wrote:

Yes, you get a warning about a possible man-in-the-middle attack
because the key changed.

Sorry, I messed that up. You're right. But as the connection is closed
after the warning the user has no chance to correct the error without
verifying the new key settings with the server admin. This is a nasty
situation in a environment where lots of people log in with ssh. Email
is not trustworthy and snail mail is expensive. Recording the MD5 sum
of the new public key on an answering machine might do the trick.

This is configurable with the StrictHostKeyChecking setting (and
actually, I'd forgotten that if it's set to "yes", you'll get the
behavior you described. So we were actually both right).
.