"WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" is displayed when trying to export Tech support file from CLI
Symptom
- When trying to export tech support file from CLI, error message "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" is displayed
>scp export tech-support to xxxxxxxx@tacupload.paloaltonetworks.com:./
ElasticSearch health status output.
Group 'batch' resume
Finish generating tech support.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:bfxVZCFXpQXXP70meRqZnXT4MGy9LiWiXVGQos1P9Gc.
Please contact your system administrator.
Add correct host key in /opt/pancfg/home/admin/.ssh/known_hosts to get rid of this message.
Offending RSA key in /opt/pancfg/home/admin/.ssh/known_hosts:1
RSA host key for tacupload.paloaltonetworks.com has changed and you have requested strict checking.
Host key verification failed.
lost connection
Environment
- Any Panorama or Log Collector
- Supported PAN-OS
Resolution
- Try this below command to delete all known host keys from the log collector CLI
>delete user-file ssh-known-hosts
- After executing the above command, please try to export the log collector tech support file using SCP export.
>scp export tech-support to xxxxxxxx@tacupload.paloaltonetworks.com:./