Avoiding the remote host identification changed warning ssh'ing to localhost

If you run several virtual machines under VirtualBox and use port forwarding (Settings > Network > Advanced > Port Forwarding) to map its port 22 to a localhost port so that you can ssh to it, you will end up with several remote hosts all accessed from localhost but at different ports. In such a situation, if you have an older ssh client, you might end up with this well known warning when you try to connect:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

The reason is that older ssh clients only store the domain name or the IP address of the server in the ~/.ssh/known_hosts file. So there can only be one host key for localhost and when you connect to a different port there is a key mismatch. Newer ssh clients store the port number also and don't have this problem. You can fix this temporarily by deleting the host key entry but when you connect to another server it happens again.

I've seen solutions that suggest suppressing the host key check. There is another way. All addresses in the 127.0.0.0/8 subnet are localhost so you can use distinct IP addresses for each VM. For example in ~/.ssh/config you could have something like this:

Host centos64

Hostname localhost

        Port 2201

Host debian64

Hostname 127.0.0.2

        Port 2202

This way there are distinct host key entries for the two VMs and you will not get the dreaded clash and warning.

Once again, this is only necessary when using an older ssh client.

SFTP is not FTP

Today I encountered another confused person who thought that to provide SFTP service, he had to install an FTP server.

I'm writing this post so that I can point people to it next time I encounter this misconception.

Yes, SFTP stands for Secure File Transfer Program and FTP stands for File Transfer Protocol but there the similarity ends. SFTP is run over a ssh connection, which normally uses the single service port 22. FTP is a different protocol using two ports, normally 20 and 21 for data and command (I will not go into the complexity of active and passive modes here). They are not related. The Wikipedia entry for FTP explains it succinctly. SFTP servers are different from FTP servers. Although there are clients that are capable of connecting to both types of servers, for example, Filezilla.

If you can ssh to a server, you can probably sftp also. I qualified that claim with "probably" because the sftp functionality has to be enabled and allowed to users.

SFTP is much much preferred over FTP due to encryption of the stream.

To complicate things there is a variant of FTP called FTPS which uses TLS to encrypt the stream.

Clone an IPCop installation over the network

Perhaps you need to clone IPCop to replace the disk, make a working copy for another machine, alter the sizes of the partitions, or for some other reason. This can be done over the network with nothing more than ssh access to IPCop. Remember, clone means clone and you get all the settings and logs replicated, so you should deal with those once you have the clone working.

Connect up the destination disk to a spare machine and boot up with a Puppy Linux CD. There is no reason some other distro couldn't be used, it's just that Puppy Linux runs off the CD and allows you to connect up the disk as the normal primary disk. Another rescue distro would work equally well.

Assuming you have Puppy Linux up and running, first get a network connection with the Network Wizard. Then partition your disk. IPCop creates three partitions, the first for /boot, the second for /var/log and the third for /. The first has only to be about 8-10MB. The third should be about 200-500MB, and the second can use up all the remaining space. You can look at your current IPCop to see the usage of space and tweak these numbers. Use fdisk to do the partition. I will not give a fdisk tutorial here, you can use the built-in help or find its documentation. If your Linux kernel is 2.6 and addresses the disk as sda then substitute sda for hda in the following instructions. In what follows, # is the root shell prompt, which you don't type and // starts a comment, which you don't type either.

# fdisk /dev/hda
// create primary partitions 1, 2 and 4 with the required sizes
// change the type to Linux (0x83)
// (optional) set partition 1 to bootable

Now format the partitions ext3. A gotcha is that recent mke2fs programs set various features on the filesystems that are not supported by the e2fsck program in IPCop. You need to avoid them.

# mke2fs -j -O none,filetype,sparse_super /dev/hda1
# mke2fs -j -O none,filetype,sparse_super /dev/hda2
# mke2fs -j -O none,filetype,sparse_super /dev/hda4

Mount the partitions

# mkdir /ipcop
# mount /dev/hda4 /ipcop
# mkdir -p /ipcop/boot /ipcop/var/log
# mount /dev/hda1 /ipcop/boot
# mount /dev/hda2 /ipcop/var/log

Create a swapfile. The size should be 2x RAM on the destination machine but this is not critical.

# dd if=/dev/zero of=/ipcop/swapfile bs=1M count=64
// e.g. for a 64MB swapfile
# mkswap /ipcop/swapfile

Make some required directories.

# mkdir /ipcop/proc

Now copy the files over. It doesn't take very long, IPCop is a small distro. The backslashes indicate either type it all on one line or type the backslash to the shell to continue the line. You will see the filenames as they are extracted.

# cd /ipcop
# ssh -p 222 root@first.ipcop.box \
 'cd /; tar cf - --numeric-owner bin boot dev etc fastboot home lib mnt root sbin tmp usr var' | \
 tar xvf -

Now you need to install GRUB. grub> is the GRUB prompt.

# grub
grub> device (hd0) /dev/hda
grub> root (hd0,0)
grub> setup (hd0)
grub> quit

GRUB should display messages about installing various files. Now umount the IPCop disk.

# cd /
# umount /ipcop/var/log
# umount /ipcop/boot
# umount /ipcop

Now take out the Puppy Linux CD and reboot with the primary disk. For some reason, only the bootloader has been installed, not the menu, so for the first time you need to run GRUB manually. You might want to disconnect the network cable so that you don't interfere with the network in case IPCop starts using the network cards.

grub> root (hd0,0)
grub> kernel /vmlinuz... root=/dev/hda4
grub> boot

You can use tab file completion to fill out the vmlinuz kernel filename. Once booted into IPCop you need to run grub-install to fix the GRUB menu. BTW, inside IPCop you do not substitute sda for hda because IPCop runs Linux 2.4.

# grub-install --no-floppy /dev/hda

If you have no floppy, you might want to remove the line with fd0 in /boot/grub/device.map otherwise the probing will take a long time.

Now you can login to your new IPCop box and fix up the hardware details and the configuration.