修復警告：遠端主機識別已更改錯誤

今天，我嘗試用 SSH 登入我的遠端 Ubuntu 20.04 LTS 伺服器，結果收到這條訊息 - 警告：遠端主機識別已更改！。

$ ssh ostechnix@192.168.225.52

範例輸出：

@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:K/jEKNQCYYOilJxOZc7qAWlu4xu0nW+MD09DfJL7+gc.
Please contact your system administrator.
Add correct host key in /home/sk/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /home/sk/.ssh/known_hosts:11
  remove with:
  ssh-keygen -f "/home/sk/.ssh/known_hosts" -R "192.168.225.52"
ECDSA host key for 192.168.225.52 has changed and you have requested strict checking.
Host key verification failed.

錯誤 - 警告遠端主機識別已變更

這其實不是錯誤訊息。這只是一個安全通知，表示自從你上次連線後，給定遠端系統的 ECDSA 主機金鑰已經更改。如你可能已經知道，當我們第一次從本地系統透過 SSH 存取遠端系統時，遠端主機傳送的 ECDSA 金鑰指紋會被快取，並存儲在我們本地系統的 $HOME/.ssh/known_hosts 檔案中。

當您重新安裝遠端系統或給多個遠端系統分配相同的 IP 地址後，當身份（指紋）發生變化時，上述警告訊息會出現。

修復 Linux 中的「警告：遠端主機身份已更改」錯誤

要解決此問題，只需使用以下命令從本地系統中移除該 IP 地址的快取鍵：

$ ssh-keygen -R 192.168.225.52

範例輸出：

# Host 192.168.225.52 found: line 11
/home/sk/.ssh/known_hosts updated.
Original contents retained as /home/sk/.ssh/known_hosts.old

修復 Linux 中的「警告：遠端主機身份已更改」錯誤

你也可以使用 -f 標誌明確指定 known_hosts 文件的路徑，如下所示。

$ ssh-keygen -f "/home/sk/.ssh/known_hosts" -R "192.168.225.52"

上述命令將刪除本地系統的 known_hosts 文件中屬於遠程主機的所有鍵。同時，known_hosts 文件的舊內容將保留在名為 "known_hosts.old" 的文件中。

如果你使用不同的 SSH 端口，你需要像下面這樣明確地指出它：

$ ssh-keygen -R 192.168.225.52:1234

這裡，1234 是 SSH 端口號。請將其替換為您的實際 SSH 端口號。

移除金鑰後，再次嘗試使用指令 SSH 登入遠端系統：

$ ssh ostechnix@192.168.225.52

輸入「yes」並按下 ENTER 以將遠端主機金鑰添加到本地系統：

The authenticity of host '192.168.225.52 (192.168.225.52)' can't be established.
ECDSA key fingerprint is SHA256:K/jEKNQCYYOilJxOZc7qAWlu4xu0nW+MD09DfJL7+gc.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.225.52' (ECDSA) to the list of known hosts.
ostechnix@192.168.225.52's password:

現在你可以透過 SSH 存取遠端系統。