"WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" is displayed when trying to export Tech support file from CLI

"WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" is displayed when trying to export Tech support file from CLI

2773
Created On 06/01/23 23:02 PM - Last Modified 04/08/25 23:34 PM


Symptom


  • When trying to export tech support file from CLI, error message "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" is displayed

>scp export tech-support to xxxxxxxx@tacupload.paloaltonetworks.com:./ 
ElasticSearch health status output.
Group 'batch' resume
Finish generating tech support.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:bfxVZCFXpQXXP70meRqZnXT4MGy9LiWiXVGQos1P9Gc.
Please contact your system administrator.
Add correct host key in /opt/pancfg/home/admin/.ssh/known_hosts to get rid of this message.
Offending RSA key in /opt/pancfg/home/admin/.ssh/known_hosts:1
RSA host key for tacupload.paloaltonetworks.com has changed and you have requested strict checking.
Host key verification failed.
lost connection



Environment


  • Any Panorama or Log Collector
  • Supported PAN-OS


Resolution


  1. Try this below command to delete all known host keys from the log collector CLI 

>delete user-file ssh-known-hosts

  1. After executing the above command, please try to export the log collector tech support file using SCP export.
>scp export tech-support to xxxxxxxx@tacupload.paloaltonetworks.com:./ 


 



Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000bps9CAA&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail