From: "Thomas A. Moulton" <tom@...>
Date: 2012-02-22T21:29:29+09:00
Subject: Re: DNS Spoofing?

It is not a local issue, I tried from 3 systems at 2 different locations.

tom

On 02/22/2012 07:28 AM, Thomas A. Moulton wrote:
> Has the IP for rubyforge.org changed in the past 12-24 hours?
>
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> @       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> The RSA host key for rubyforge.org has changed,
> and the key for the according IP address 50.56.192.79
> is unknown. This could either mean that
> DNS SPOOFING is happening or the IP address for the host
> and its host key have changed at the same time.
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
> Someone could be eavesdropping on you right now (man-in-the-middle 
> attack)!
> It is also possible that the RSA host key has just been changed.
> The fingerprint for the RSA key sent by the remote host is
> e0:48:2e:9e:f9:26:67:61:7d:29:db:6e:32:13:a1:2f.
> Please contact your system administrator.
> Add correct host key in /.ssh/known_hosts to get rid of this message.
> Offending key in /.ssh/known_hosts:3
> RSA host key for rubyforge.org has changed and you have requested 
> strict checking.
> Host key verification failed.
> cvs [status aborted]: end of file from server (consult above messages 
> if any)
>