Problem

You might see the following warning when you try connecting to the front-end system Ela using the ssh command:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ED25519 key sent by the remote host is…

The same applies in case of the POSSIBLE DNS SPOOFING DETECTED warning. The message means your SSH client is no longer recognizing ela, probably because its default key has changed. Server keys updates can sometimes happen as part of security-hardening system updates. CSCS will always notify you on the rare occasions a warning like this is expected. Should you see this warning in the future without a corresponding official notification from CSCS, close the connection without accepting the new keys and contact us as soon as possible

Solution

Your first task is to make sure that the fingerprint sent by the remote host in the warning message matches one of the following:

SHA256 fingerprint
256 SHA256:CTt/IUUObWMase08gHXQjysMbc8nBahV+gGHigMkvLY ela.cscs.ch (ED25519)
256 MD5:85:81:19:59:2e:13:06:2d:52:55:c1:95:1c:38:4b:18 ela.cscs.ch (ED25519)

Again, if the fingerprint you received does not match any of the above, abort the connection and contact us. Otherwise, if you have an exact match, continue with the steps suggested in the warning message to update your known_hosts file.

For example, you can run the following command:

ssh-keygen -R "ela.cscs.ch" -f ~/.ssh/known_hosts

This command removes all keys belonging to ela.cscs.ch from the file .ssh/known_hosts (the default local list of trusted SSH servers).

The first time you try to reconnect, you will receive a message like the one below:

The authenticity of host 'ela.cscs.ch' can't be established.
[...] Are you sure you want to continue connecting (yes/no)?

Enter yes to confirm this new identity of ela and successfully complete the connection.