Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Useful comment about git using the ECDSA key instead and running into a mismatch issue (from the Github discussion):

=====

After I followed the instructions to remove the old RSA key, `git pull` started using the ECDSA key, and now shows this warning:

    Warning: the ECDSA host key for 'github.com' differs from the key for the IP address '20.205.243.166'
    Offending key for IP in /home/forge/.ssh/known_hosts:87
    Matching host key in /home/forge/.ssh/known_hosts:88
    Are you sure you want to continue connecting (yes/no)?
In this case, I think the old ECDSA key for the github.com IP needs to be removed from `known_hosts`. This can be done with:

    ssh-keygen -f ~/.ssh/known_hosts -R 20.205.243.166
It worked for me, hope this helps.

I'm not sure why the ECDSA key of the github.com IP has supposedly changed - maybe someone can clarify this?



The ECDSA key hasn't changed. As pointed out elsewhere in this thread, the official command `ssh-keygen -R github.com` is incomplete -- it doesn't remove IP address entries, they need to be removed manually. What you got was a conflict between the ECDSA key and the old RSA key left over in ~/.ssh/known_hosts (the error message was unclear).

Since GitHub's IP address is not stable, I suggest disabling the IP-checking feature using

    Host github.com
         CheckHostIP no
The CheckHostIP feature is pretty useless anyway, it just gives a warning when the IP changes and gives a better diagnostic message if the key and IP both change at the same time (references: https://serverfault.com/questions/1040512/ssh-how-does-the-o..., https://unix.stackexchange.com/questions/285520/why-does-ssh...).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: