I'm getting "SSH Key mismatch: WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!"

[BigFreddy]

Hi,

I have nuked old installation of my OPNSense, did a new install then proceeded to do the initial configuration via the web GUI followed by restoring the old config via the web browser in the said web gui. I then tried SSHing into my firewall and was greeted with this error:

Code Select Expand

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@  WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!  @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
ECDSA Key here
Please contact your system administrator.
Add correct key in system path here/known_hosts to get rid of this message.
Offending ECDSA key in system path here/known_hosts:1
remove with:
command to remove it
ECDSA host key for IP Here has changed and you have requested strict checking.
Host key verification failed.

So my questions are:

1) Does major upgrade of the Firewall from one version to another major one could cause to rotate SSH keys ?
2) Does reinstalling the firewall, doing the initial setup in Web GUI followed by restore of the configuration file via web gui would change SSH keys ?

I'm wondering if something nefarious is happening on my firewall as reading online, restoring config file to OPNSense should still retain the old SSH Keys but it this case this haven't happened.

Thanks

[Patrick M. Hausen]

2) Does reinstalling the firewall [...] change SSH keys?

Yes. This is expected. The keys are generated when a host first boots after installation. Remove the old key(s) from your ~/.ssh/known_hosts and acknowledge the new one(s).

[BigFreddy]

2) Does reinstalling the firewall [...] change SSH keys?

Yes. This is expected. The keys are generated when a host first boots after installation. Remove the old key(s) from your ~/.ssh/known_hosts and acknowledge the new one(s).

Thanks for confirming. Would SSH Keys be retained from the config file if I imported it during the Firewall install itself rather than in Web GUI after the installation ? I read somewhere on this forum that apparently the config file should retain the old keys if you import it that way but not sure if something changed with OPNSense over the years and its different now.

[Patrick M. Hausen]

I am not aware the host keys are saved in the configuration, but I might be wrong.

[nero355]

IMHO you should let the OpenSSH Server Keys simply be what they are and only take care of your own OpenSSH User Private/Public Keys.

I can remember upgrading FreeBSD in the past via the whole /usr/src/ and /usr/ports/ procedure and then from time to time you had to supply some random keystrokes to OpenSSH Server during the first boot after it was upgraded and I was perfectly fine with that! :)

Sometimes there also security related reasons for regenerating the keys, so if your Server does it then consider it on the Client side too !!



_{This is a story from the FreeBSD 4/5/6 era but it still applies today IMHO when it comes to the security aspect of it!}