本文最后更新于：2022年2月27日 14:52

前言

一年前，就踩过这个坑，这一次又踩一次，故记录下来，方便自己日后查阅，以来提醒自己，不要转牛角尖，多方面考虑。

现象

ssh -p 22230 -o StrictHostKeyChecking=no -o PreferredAuthentications=password root@192.168.1.16
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:o9Au/huOZvnNvwYUpHsDSaKTdDEPd7YTuANfaZCk8LM.
Please contact your system administrator.
Add correct host key in /Users/jaryoung/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /Users/jaryoung/.ssh/known_hosts:24
Password authentication is disabled to avoid man-in-the-middle attacks.
Keyboard-interactive authentication is disabled to avoid man-in-the-middle attacks.
UpdateHostkeys is disabled because the host key is not trusted.
root@192.168.1.16: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

现象：无法登录到的本地启动的vagrant启动的虚拟机上面去。

排查

排查思路1（失败）

cat /etc/ssh/sshd_config | grep "Root"，查询是否能够允许root用户登录
cat /etc/ssh/sshd_config | grep "PasswordAuthentication" ，查询是否允许密码登录

上面的排查，均为yes，说明是允许root用户登录，说明排查思路不对。

排查思路2（有效）

一开始，尝试过很多其他办法，但是最后发现，自己忽略一些错误日志：

Please contact your system administrator.
Add correct host key in /Users/jaryoung/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /Users/jaryoung/.ssh/known_hosts:24
Password authentication is disabled to avoid man-in-the-middle attacks.

简单分析一些/Users/jaryoung/.ssh/known_hosts上面文件的信息，发现问题所在。

know_hosts，为客户端验证服务端身份的凭证依据。

解决办法

经过上面的排查，问题已经比较清晰。只要将之前的（/Users/jaryoung/.ssh/known_hosts）本地保存的服务端身份凭证移除掉。

1	`192.168.1.16 ssh-ed25519 ....mnhMJOSYzQaiN6`

移除已经保存的凭证记录，重新尝试一下。

验证

ssh-copy-id -f -i ~/.ssh/id_rsa.pub -p 22230  vagrant@192.168.1.16
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/Users/jaryoung/.ssh/id_rsa.pub"
vagrant@192.168.1.16's password:
/etc/profile.d/lang.sh: line 19: warning: setlocale: LC_CTYPE: cannot change locale (UTF-8): No such file or directory

Number of key(s) added:        1

Now try logging into the machine, with:   "ssh -p '22230' 'vagrant@192.168.1.16'"
and check to make sure that only the key(s) you wanted were added.