fedora-infrastructure

#12639 pkgs/dns: SSH access warns about wrong host key in SSHFP resource record
Closed: Fixed by james. Opened by nphilipp.

Closed: Fixed
Reopen Issue

Describe what you would like us to do:

Update the SSHFP RR in DNS for pkgs.fedoraproject.org, I guess.

Right now, I get this (note third line from the bottom):

nils@gibbon:~> ssh pkgs.fedoraproject.org
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:dJN0nFWBcWK7SFs2k0nnsO+XNA9+aEDY4FWO7uhxTN8.
Please contact your system administrator.
Update the SSHFP RR in DNS with the new host key to get rid of this message.
Welcome nphilipp. This server does not offer shell access.
Connection to pkgs.fedoraproject.org closed.

This is with VerifyHostKeyDNS yes, as per the Package Maintenance Guide. I assume this has to be worked into the DNS repo, but have no idea how to do it and I’d rather not break things.

When do you need this to be done by? (YYYY/MM/DD)

Eventually.

I am also seeing this, and already tried adding https://admin.fedoraproject.org/ssh_known_hosts to my own .ssh/known_hosts file, which didn't help.

Metadata Update from @phsmoura:
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: medium-gain, medium-trouble, ops

@pghmcfc Knows hosts will not help as this is checking over DNS. I'm hitting this as well.

Metadata Update from @zlopez:
- Issue tagged with: dc-move

FWIW I checked with https://github.com/mlgupta/sshfp ... and running that confirms that we have host keys in DNS but none match the host keys on the server.
Now to see how to get DNS fixed.

I think I've fixed it now ... at least the above checker is happy, and all the things I've read from various places match up with that is in DNS now. Added some comments, so hopefully it won't break again in the future (not that anyone is planning another DC move).

Feel free to ping me or reopen if anything complains (about sshfp ;).

Metadata Update from @james:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

dc-move medium-gain medium-trouble ops

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.