Working with '[HOST_KEY_NOT_VERIFIABLE] Failed to verify the `ssh-rsa` fingerprint host key' in sshj

Question

I have a strange problem with sshj (I am using sshj v0.6.0), for which I need some help from someone. Public key authentication works fine on some machines, but doesn't work fine on other machines, and I see an error below.

The only difference I could make out was that the UNIX identifier in question, because of coonradt, seems to have the following configuration configuration in ~ / .ssh / config only in the field where the following errors are triggered.

Host * Protocol 1,2 FallBackToRsh no ForwardAgent yes ForwardX11 yes PasswordAuthentication yes RhostsAuthentication no RhostsRSAAuthentication no RSAAuthentication yes NoHostAuthenticationForLocalhost yes StrictHostKeyChecking no KeepAlive yes 

From the above configuration file, I found out that the intended ID should use protocol 1.2, and I suspect this may have something to do with my errors (I'm not very sure about this, but this is just a hunch)

For all other UNIX identifiers for which this works fine, I do not have such a configuration file.

PS: I cannot change the configuration of the UNIX identifier "coonradt" because this identifier is used by the hudson central servers.

I am amazed if someone can help me advise what might be wrong here.

The following is the error that I see:

 Oct 24, 2011 2:30:37 AM net.schmizz.sshj.DefaultConfig initCipherFactories WARNING: Disabling high-strength ciphers: cipher strengths apparently limited by JCE policy Oct 24, 2011 2:30:38 AM net.schmizz.sshj.transport.TransportImpl init INFO: Client identity string: SSH-2.0-SSHJ_0_6_0 Oct 24, 2011 2:30:38 AM net.schmizz.sshj.transport.TransportImpl init INFO: Server identity string: SSH-1.99-OpenSSH_4.3 Oct 24, 2011 2:30:38 AM net.schmizz.sshj.transport.KeyExchanger sendKexInit INFO: Sending SSH_MSG_KEXINIT Oct 24, 2011 2:30:38 AM net.schmizz.sshj.transport.KeyExchanger handle INFO: Received SSH_MSG_KEXINIT Oct 24, 2011 2:30:38 AM net.schmizz.sshj.transport.kex.AbstractDHG init INFO: Sending SSH_MSG_KEXDH_INIT Oct 24, 2011 2:30:38 AM net.schmizz.sshj.transport.KeyExchanger handle INFO: Received kex followup data Oct 24, 2011 2:30:38 AM net.schmizz.sshj.transport.kex.AbstractDHG next INFO: Received SSH_MSG_KEXDH_REPLY Oct 24, 2011 2:30:38 AM net.schmizz.sshj.transport.TransportImpl die SEVERE: Dying because - net.schmizz.sshj.transport.TransportException: [HOST_KEY_NOT_VERIFIABLE] Could not verify `ssh-rsa` host key with fingerprint `ca:0b:b3:7f:53:5a:e3:bc:bf:44:63:d8:2d:26:c0:41` for `mymachine.domain.com` on port 22 Oct 24, 2011 2:30:38 AM net.schmizz.concurrent.Promise tryRetrieve SEVERE: <<kex done>> woke to: net.schmizz.sshj.transport.TransportException: [HOST_KEY_NOT_VERIFIABLE] Could not verify `ssh-rsa` host key with fingerprint `ca:0b:b3:7f:53:5a:e3:bc:bf:44:63:d8:2d:26:c0:41` for `mymachine.domain.com` on port 22 Oct 24, 2011 2:30:38 AM net.schmizz.sshj.transport.TransportImpl setService INFO: Setting active service to null-service Oct 24, 2011 2:30:38 AM com.test.jaws.execution.ssh.impl.SSHJClientImpl$ExceptionHandler handleSevereCondition SEVERE: mymachine.domain.com is not added to your /x/home/coonradt/.ssh/known_hosts file. Throwable occurred: net.schmizz.sshj.transport.TransportException: [HOST_KEY_NOT_VERIFIABLE] Could not verify `ssh-rsa` host key with fingerprint `ca:0b:b3:7f:53:5a:e3:bc:bf:44:63:d8:2d:26:c0:41` for `mymachine.domain.com` on port 22 at net.schmizz.sshj.transport.KeyExchanger.verifyHost(KeyExchanger.java:222) at net.schmizz.sshj.transport.KeyExchanger.handle(KeyExchanger.java:373) at net.schmizz.sshj.transport.TransportImpl.handle(TransportImpl.java:477) at net.schmizz.sshj.transport.Decoder.decode(Decoder.java:127) at net.schmizz.sshj.transport.Decoder.received(Decoder.java:195) at net.schmizz.sshj.transport.Reader.run(Reader.java:72) 

Answer 1

How to add HostKeyVerifier addon for this machine?

 sshClient.addHostKeyVerifier("ca:0b:b3:7f:53:5a:e3:bc:bf:44:63:d8:2d:26:c0:41"); 

The reason this does not happen automatically is probably because the known_hosts file is not in $ (user.home) /. ssh / known_hosts. You can also explicitly load known hosts from a specific location.

 sshClient.loadKnownHosts(new File("path_to_known_hosts")); 

Answer 2

You can configure the SSH client to accept all keys without any verification (ignores host key verification)

 SSHClient sshClient = new SSHClient(); sshClient.addHostKeyVerifier(new PromiscuousVerifier()); ... 

Answer 3

 try { ssh.connect(envConf.getIp(), port); } catch (TransportException e) { if (e.getDisconnectReason() == DisconnectReason.HOST_KEY_NOT_VERIFIABLE) { String msg = e.getMessage(); String[] split = msg.split("`"); String vc = split[3]; ssh = new SSHClient(); ssh.addHostKeyVerifier(vc); ssh.connect(envConf.getIp(), port); } else { throw e; } } ssh.authPassword(envConf.getName(), envConf.getPw()); ssh.newSCPFileTransfer().download(envConf.getHomePath() + FilePath, toPath); 

Answer 4

For an alternative answer, make sure that the host name you are trying to connect to exactly matches your known_hosts file. I tried to connect to the full URL bob.insidenetwork.pvt , but my known_hosts file had only bob as an entry, because when I ssh manually, I'm too lazy to type the whole URL ..

Answer 5

This works for me:

 try (final SSHClient sshClient = new SSHClient()) { sshClient.addHostKeyVerifier(new PromiscuousVerifier()); KeyProvider keys = sshClient.loadKeys("path_to_private_key.ppk"); sshClient.connect("hostname"); sshClient.authPublickey("username", keys); } catch (IOException e) { }