ssh: handshake failed: possible man-in-the-middle attack: knownhosts: key mismatch

[LennyPenny]

wishlist: 0.9.0

I'm getting this error when trying to connect to some of my hosts

Wishlist

Something went wrong:

ssh: handshake failed: possible man-in-the-middle attack: knownhosts: key mismatch

However when I just do normal ssh <hostname> I can connect just fine and the ~/.ssh/known_hosts file looks correct.

Wishlist.log says this:

lenny@skeleton ~> cat wishlist.log
2023/02/09 21:48:27 setting delegate height: 2
2023/02/09 21:48:28 offering public key via ssh agent: ssh-ed25519 xxx
2023/02/09 21:48:28 offering public key via ssh agent: ssh-ed25519 xxx
2023/02/09 21:48:28 got an error: failed to create session: connection failed: ssh: handshake failed: possible man-in-the-middle attack: knownhosts: key mismatch
2023/02/09 21:48:28 error: failed to create session: connection failed: ssh: handshake failed: possible man-in-the-middle attack: knownhosts: key mismatch

I'm using gpg-agent btw.

[caarlos0]

Hi!

Wishlist uses its own known_hosts, stored at .wishlist in the CWD: https://github.com/charmbracelet/wishlist#running-it

Have you looked into it? It's likely that said host changed and is now offering another key...

[LennyPenny]

Hmm no .wishlist folder is created in the CWD for me.

Btw: is it possible to have this just live at a fixed location instead of the cwd?

[caarlos0]

hmm, I improved the error message there, can you check again with main, it should display which known hosts it's using...

[LennyPenny]

ssh: handshake failed: possible man-in-the-middle attack: knownhosts: key mismatch - if your host's key changed, you might need to edit "/home/lenny/.ssh/known_hosts"

however the keys are not mismatched (normal ssh works, and when I cat /etc/ssh/ssh_host_ed25519_key.pub on the server it matches the entry in my ~/.ssh/known_hosts

note: I have both rsa and ed25519 host keys on my server - maybe it's comparing the rsa host key to the ed25519 key in my known_hosts?

[LennyPenny]

aah yes I found the issue!

When the server offers both rsa and ed25519 host keys and the local known hosts only contains the ed25519 one this error appears. If I add both keys or just the rsa one locally it works fine. However then #151 is the next issue

[caarlos0]

https://github.com/golang/go/issues/36126

seems like its a bug in Go...

[caarlos0]

I'll try to take a swing at it later... but regardless... it'll take some time to get merged and released - if they accept it.

[caarlos0]

let's go! https://github.com/golang/crypto/pull/254

[caarlos0]

update: still waiting on that PR :(