"Refused to connect"

[spektrolyte]

Hi I set up Proxmox 6.2 last week and configured a pfSense router in a VM. Everything was good and I've been learning about VMs and containers to build my setup.

However, in the last 24h I noticed that the admin interface was sporadically unavailable, and today I can't get to it at all, saying "Refused to connect".

I have no idea why this has started happening and now I can't get to the admin interface despite pfSense still running and being accessible via my laptop. The server hasn't rebooted and I haven't changed anything in Proxmox since installing it last week. I can ping the admin IP from my laptop. If I try and log in with SSH I get this:

ssh root@192.168.1.1
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:WfREy84wuTHiJf8pgH9LMq+pxB0TMZMy07lTeELz8ck.
Please contact your system administrator.
Add correct host key in /Users/thom/.ssh/known_hosts to get rid of this message.
Offending RSA key in /Users/thom/.ssh/known_hosts:8
RSA host key for 192.168.1.1 has changed and you have requested strict checking.
Host key verification failed.

 

[Alwin]

ssh root@192.168.1.1

Does the IP exist more than once on the network? You can check with arp -a (net-tools) if the same IP has multiple MAC addresses. Or use some arp-scan(ing) tool to see what MACs are on the network.

 

[spektrolyte]

Hi Alwin,

No there are only 4 devices each with unique IPs. The Proxmox install, my laptop, a time capsule and the pfSense router.

 

[Alwin]

If you never logged in through SSH on the server after installation, then it could be a leftover. But in any case, you can connect to the web interface and run a console to check the fingerprint (ssh-keyscan localhost). If its the same as shown in the message, then its probably from your Proxmox VE node.