Multiple ssh tunnels and bad key fingerprints

theNbomr · 06-14-2008, 12:57 PM

I frequently use ssh tunnels to create access to remote hosts through otherwise blocked channels. This scenario involves 4 or more hosts:
1. The local host, at which console I am sitting.
2. A gateway host, through which I will tunnel connections.
3, 4, ... Two or more remote hosts, behind the gateway host, to which I wish to connect.

On the local host, I establish two tunnels, like so:

Code:

ssh -L 22001:remote1:22  -L 22002:remote2:22 gateway.remote.site

Now, in a separate session on my local host, I can connect to remote1 through the tunnel, like so:

Code:

ssh -p 22001 localhost

Nothing new here, everything works fine.
Now, in yet another session on the local host, I want to create a connection to remote2:

Code:

ssh -p 22002 localhost

Since ssh sees this as the same host (localhost) as the connection to remote1, I get the unfriendly:

Code:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
01:24:95:fb:f5:92:3d:4e:de:bd:4b:57:e8:23:15:cd.
Please contact your system administrator.
Add correct host key in /home/user/.ssh/known_hosts to get rid of this message.
Offending key in /home/user/.ssh/known_hosts:39
RSA host key for localhost has changed and you have requested strict checking.
Host key verification failed.

It is easy enough to quickly edit ~/.ssh/known_hosts, to get rid of the message and retry the connection, but this seems both cumbersome and somewhat insecure. What, if anything, can I do to get around this situation?
--- rod.

rayfordj · 06-14-2008, 05:34 PM

What I've done on my fedora system where I perform similar tasks as you demonstrate is to create a config file.

My intention was not to overcome what you are after but rather that turned out to be an added bonus. I was just lazy and tired of having to remember what i wanted to forward where and on what ports for which systems and so on and so forth...

example ~/.ssh/config

Code:

Host gateway
  User <whatever-user>
  HostName gateway.remotesite.moc
  LocalForward localhost:22001 10.10.10.10:22
  LocalForward localhost:22002 10.20.20.20:22
Host remote1
  Port 22001
  HostName 127.0.0.1
  User theNbomr
Host remote2
  Port 22002
  HostName 127.0.0.1
  User rod
  ForwardX11 yes
# ...

then to start your first connection

Code:

ssh gateway

another shell

Code:

 ssh remote1

3rd shell

Code:

 ssh remote2

Notes:
you may need to "clean" known_hosts initially).
permissions on ~/.ssh/config are -rw-r--r--

Hope this helps.

theNbomr · 06-14-2008, 08:15 PM

Thanks rayfordj.
Your solution didn't quite work for me, but it got me to look in the right place (who knew there was a config file?). What happened with your solution was that ssh saw the same HostName for each tunneled connection, and complained as before. What does work is adding the HostKeyAlias option:

Code:

Host remote2
  Port 22002
  HostName 127.0.0.1
  User rod
  HostKeyAlias rod
  ForwardX11 yes

A unique alias for each connection does the trick. The HostKeyAlias option can also be specified on the ssh commandline by using the '-o' option:

Code:

ssh -X -p 22001 -o HostKeyAlias=rod localhost

Thanks for getting me going. I ended up with a better solution than I hoped for. Me happy.

--- rod.