# Answer '''yes''' to add to the list of known hosts.
[[Image:spoof.png|thumb|right|500px|If you receive a message like the one displayed above, you should investigate why it is happening as it could indicate a '''serious security issue''', or it could just mean that something on '''the host has changed'''(i.e. the OS was <u>reinstalled</u>)]]
<pre>
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for centos3 has changed,
and the key for the according IP address 192.168.235.13
is unchanged. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
Offending key for IP in /home/user1/.ssh/known_hosts:10
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
96:92:62:15:90:ec:40:12:47:08:00:b8:f8:4b:df:5b.
Please contact your system administrator.
Add correct host key in /home/user1/.ssh/known_hosts to get rid of this message.
Offending key in /home/user1/.ssh/known_hosts:53
RSA host key for centos3 has changed and you have requested strict
checking.
Host key verification failed.
</pre>
{{Admon/note |POSSIBLE DNS SPOOFING DETECTED | If you receive a message like the one displayed above, you should investigate why it is happening as it could indicate a serious security issue, or it could just mean that something on the host has changed, i.e. the OS was reinstalled.}}
<ol><li value="4">When prompted enter your password for your ops235 account on centos3.</li>
<li>Establish an ssh connection using your learn account from centos3 to centos2.</li></ol>
{{Admon/note |Proof of Established SSH Connection | When you have both ssh connections established between centos2 and centos3 check your network connections using the netstat command. You should now see at least 2 TCP connections with a state of ESTABLISHED. One connection represents the connection from centos2 to centos3 and the other represents the connection from centos3 to centos2. You should also see that you still have ssh listening to TCP port 22. Notice that the client side of each connection uses a random port number in the upper ranges. This common behaviour for client side applications.}}
<ol><li value="6">Logout of your ssh connection by typing <code>exit</code>.
<li>Check the state of the connection after logging out. Wait a few minutes and then check again. Record your observations.</li>
