known_hosts messed up after ssh-host-key-changes instructions

[josir]

I followed the instructions about the new host keys:

https://bitbucket.org/blog/ssh-host-key-changes

After that, when I tried to pull something from bitbucket, I got:

Warning: the ECDSA host key for 'bitbucket.org' differs from the key for the IP address '2406:da00:ff00::22e9:9f55'
Offending key for IP in /home/josir/.ssh/known_hosts:32
Matching host key in /home/josir/.ssh/known_hosts:166

I tried to remove all bitbucket keys:

ssh-keygen -R bitbucket.org

and replay the process. But the same problem occurs.

I also noticed that "curl https://bitbucket.org/site/ssh" is returning a different format that known_hosts stores.

I'm using Ubuntu 22.04

Could someone help me with that?

[Julian]

I noticed the same: curl https://bitbucket.org/site/ssh" is returning a different format
Go to the site using the browser and copy the content into ~./ssh/known_hosts

[MoG]

Thanks Julian! This worked for me. 

[Erik Yamamoto]

Same here, curl didn't work, but copy and paste directly from the link to the known_hosts file worked fine! Thanks!

[Theodora Boudale]

Hi @josir,

You can create a ticket with the support team and a support engineer will help you with these issues. You can create a ticket via https://support.atlassian.com/contact/#/

• In "What can we help you with?" select Technical issues and bugs
• In "Which product is this for?" select Bitbucket Cloud
• In the next field enter your workspace URL
• In "Are you having an issue with Bitbucket SSH Connections?" select Yes
• Then, scroll down and select Need more help? to fill in the ticket details

Kind regards,
Theodora

[josir]

Thanks Theodora. When support team respond, I will post the answer here. It can be helpfull to other users.

[Jessica Hrudey]

That would be great if you could share the answer when you get it, Josir. Thanks! I am having the same issue.

[Mickael Merlet]

Hello,
I am having the same issue too : 

$ ssh git@bitbucket.org host_key_info
Warning: the ECDSA host key for 'bitbucket.org' differs from the key for the IP address '***.***.***.*'
Offending key for IP in /c/Users/mm/.ssh/known_hosts:9
Matching host key in /c/Users/mm/.ssh/known_hosts:14
Are you sure you want to continue connecting (yes/no)? yes
You are using host key with fingerprint:
ecdsa-sha2-nistp256 SHA256:****

[artem_fedirchyk]

Hi guys, I have the same issue too. Thank you in advance for the answer!

[Jun jun Tomagan]

I'm having this issue too after following the steps from https://bitbucket.org/blog/ssh-host-key-changes. 

$ git pull
Warning: the ECDSA host key for 'bitbucket.org' differs from the key for the IP address 'xxx.xxx.xxx.x'
Offending key for IP in /home/dyeyuen/.ssh/known_hosts:6
Matching host key in /home/dyeyuen/.ssh/known_hosts:30
Are you sure you want to continue connecting (yes/no)? yes
From bitbucket.org:my_org/my_repo

...leaving this comment here to get notifications for updates. Thanks!

[Jackson Douglas]

Hi folks, I have the same issue too. Thank you in advance for the answer!

[Julian]

@Jun jun Tomagan I think you have to remove the previous entries of bitbucket in known_hosts file
Those are the old public keys 

[Julian]

I repost my previous comment here:

I noticed the same: curl https://bitbucket.org/site/ssh" is returning a different format. Go to the site using the browser and copy the content into ~./ssh/known_hosts

[Patrik S]

Hello all,

The warning message you are receiving is likely related to old entries on your known_hosts file that are pointing to the bitbucket IP, instead of the domain name bitbucket.org.

To resolve this issue, you can remove the older entries and store the new ones using the following command : 

ssh-keygen -R bitbucket.org && sed -i.old -e '/AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/d' ~/.ssh/known_hosts && curl https://bitbucket.org/site/ssh >> ~/.ssh/known_hosts

This is also covered in our Bitbucket Cloud SSH rotation FAQ

Thank you!

Patrik S

[josir]

Hi Patrick, I've done that already. But this command didn't add the new key:

josir@casa2:~$ ssh git@bitbucket.org host_key_info
You are using host key with fingerprint:
ecdsa-sha2-nistp256 SHA256:FC73VB6C4OQLSCrjEayhMp9UMxS97caD/Yyi2bhW/J0

See https://bitbucket.org/blog/ssh-host-key-changes for more details.

It's better than the published on blog because it removes the duplicated lines but it didn't add the new host key.

I created a support ticket for that:

https://support.atlassian.com/requests/BBS-202972

[hsandt]

I cannot see the ticket. Is is private?

I also noticed that https://bitbucket.org/site/ssh doesn't show the same RSA key as https://bitbucket.org/blog/ssh-host-key-changes, probably because the former is the current one and the latter shows the new RSA key after the rotation in June 20 (this means if you added it before, it will cease to work after the rotation date; but you should switch to ECDSA/ED25519 anyway).

I'll probably just add those 2 keys manually, then see if I also get a warning.