☰

为什么“ssh-keygen -R”不会从 ~/.ssh/known_hosts 中删除主机

tag-icon • tag-icon ssh
为什么“ssh-keygen -R”不会从 ~/.ssh/known_hosts 中删除主机

看来 ssh-keygen 无法识别我请求从 hosts 文件中删除的主机。

$ ssh-keygen -R 'leviathan.labs.overthewire.org'
Host leviathan.labs.overthewire.org not found in /Users/zachriggle/.ssh/known_hosts

但文件中清楚地写明了主持人known_hosts：

$ grep leviathan.labs.overthewire.org ~/.ssh/known_hosts
[leviathan.labs.overthewire.org]:2223 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDPNAn6LOV1QtSqlnnXz6eECuznq5bNIe6DLFpMNZMEI

这只有 Paramiko 捕捉到了，但似乎应该将其移除。

>>> from pwn import *
>>> ssh(user='leviathan0', password='leviathan0', host='leviathan.labs.overthewire.org', port=2223)
[x] Connecting to leviathan.labs.overthewire.org on port 2223
[-] Connecting to leviathan.labs.overthewire.org on port 2223: Failed
[!] SSH host key validation has failed for 'leviathan.labs.overthewire.org'
    If you want to trust this new SSH key, you should manually run the command:
    $ ssh-keygen -R 'leviathan.labs.overthewire.org'
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/zachriggle/pwntools/pwnlib/tubes/ssh.py", line 665, in __init__
    self.client.connect(host, port, user, password, key, keyfiles, self.timeout, compress = True)
  File "/Users/zachriggle/.pyenv/versions/3.8.3/lib/python3.8/site-packages/paramiko/client.py", line 423, in connect
    raise BadHostKeyException(hostname, server_key, our_key)
paramiko.ssh_exception.BadHostKeyException: Host key for server 'leviathan.labs.overthewire.org' does not match: got 'AAAAC3NzaC1lZDI1NTE5AAAAIIJwHwzTXHJomqOQfM8emYvBLMkHQrtG5nBz6MP/No4O', expected 'AAAAC3NzaC1lZDI1NTE5AAAAIDPNAn6LOV1QtSqlnnXz6eECuznq5bNIe6DLFpMNZMEI'

OpenSSH 很乐意接受新的主机密钥，并给出一个简单的提示。

$ ssh [email protected]
The authenticity of host 'leviathan.labs.overthewire.org (176.9.9.172)' can't be established.
ECDSA key fingerprint is SHA256:jMsE6D2121JkEDk3fqlcvkx/N42Q0jdY0KY+g1oaPEQ.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

为什么不ssh-keygen删除此行？为什么 OpenSSH 没有捕获到此命名主机有已知的 ECDSA 主机？

答案1

那是不是同一个条目。您尝试删除的条目仅适用于端口 22 - 文件中的条目适用于端口 2223。同样，您告诉 OpenSSH 连接到端口 22，但 Paramiko 连接到端口 2223。

pwn.ssh 消息不完整，应该建议ssh-keygen -R '[foo]:2223'。

大多数 SSH 客户端会跟踪每个主机：端口对的主机密钥，因为与使用单个 sshd 监听多个端口相比，使用单个地址可访问多个主机（使用 NAT 端口转发）更为常见。这甚至适用于“leviathan.labs.overthewire.org”，它在端口 22 和 2223 上有两个不同的 sshd 实例（具有不同的主机密钥）。

相关内容