ssh-keygen 似乎无法识别我请求从主机文件中删除的主机。
$ ssh-keygen -R 'leviathan.labs.overthewire.org'
Host leviathan.labs.overthewire.org not found in /Users/zachriggle/.ssh/known_hosts
但是主机显然在known_hosts文件中：
$ grep leviathan.labs.overthewire.org ~/.ssh/known_hosts
[leviathan.labs.overthewire.org]:2223 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDPNAn6LOV1QtSqlnnXz6eECuznq5bNIe6DLFpMNZMEI
这只被Paramiko抓住了，但似乎应该删除它。
>>> from pwn import *
>>> ssh(user='leviathan0', password='leviathan0', host='leviathan.labs.overthewire.org', port=2223)
[x] Connecting to leviathan.labs.overthewire.org on port 2223
[-] Connecting to leviathan.labs.overthewire.org on port 2223: Failed
[!] SSH host key validation has failed for 'leviathan.labs.overthewire.org'
If you want to trust this new SSH key, you should manually run the command:
$ ssh-keygen -R 'leviathan.labs.overthewire.org'
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/Users/zachriggle/pwntools/pwnlib/tubes/ssh.py", line 665, in __init__
self.client.connect(host, port, user, password, key, keyfiles, self.timeout, compress = True)
File "/Users/zachriggle/.pyenv/versions/3.8.3/lib/python3.8/site-packages/paramiko/client.py", line 423, in connect
raise BadHostKeyException(hostname, server_key, our_key)
paramiko.ssh_exception.BadHostKeyException: Host key for server 'leviathan.labs.overthewire.org' does not match: got 'AAAAC3NzaC1lZDI1NTE5AAAAIIJwHwzTXHJomqOQfM8emYvBLMkHQrtG5nBz6MP/No4O', expected 'AAAAC3NzaC1lZDI1NTE5AAAAIDPNAn6LOV1QtSqlnnXz6eECuznq5bNIe6DLFpMNZMEI'
OpenSSH 愉快地接受了新的主机密钥，并带有一个简单的提示。
$ ssh [email protected]
The authenticity of host 'leviathan.labs.overthewire.org (176.9.9.172)' can't be established.
ECDSA key fingerprint is SHA256:jMsE6D2121JkEDk3fqlcvkx/N42Q0jdY0KY+g1oaPEQ.
Are you sure you want to continue connecting (yes/no/[fingerprint])?
为什么不ssh-keygen删除这一行？为什么 OpenSSH 没有发现这个命名主机有一个已知的 ECDSA 主机？
那不是同一个条目。您尝试删除的条目仅适用于端口 22 – 您在文件中的条目适用于端口 2223。同样，您告诉 OpenSSH 在端口 22 上连接，但在端口 2223 上告诉 Paramiko。
pwn.ssh 消息不完整，应该有提示ssh-keygen -R '[foo]:2223'。
大多数 SSH 客户端跟踪每个主机：端口对的主机密钥，因为在单个地址（使用 NAT 端口转发）可访问多个主机比让单个 sshd 侦听多个端口更常见。这甚至适用于“leviathan.labs.overthewire.org”，它在端口 22 和 2223 上有两个不同的 sshd 实例（具有不同的主机密钥）。
本文收集自互联网，转载请注明来源。
如有侵权，请联系[email protected] 删除。
我来说两句