ssh client und StrictHostKeyChecking (Debian)

koriban · 08-31-2008, 11:44 AM

I'm maintaining several servers hosted at Amazon's EC2 Grid. The problem is that servers are running under XEN and everytime an instance is launched, a new key is generated in /etc/ssh/ssh_host_rsa_key .

Now when I login to the server via ssh I'm receiving the following error as expected:

Code:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
91:8c:61:5b:b3:78:eb:0b:23:ed:28:a3:84:b2:d5:11.
Please contact your system administrator.

Which is strange because I connect like this:

Code:

ssh -o StrictHostKeyChecking=no xx.xx.x.xx

Which should - unless I am mistaken - supress the obove error message.

Any suggestions?

By the way I'm totally aware of the possible security implications of doing this but my actual use case is Nagios's check_by_ssh command where it would be totally counter productive to manually delete the host key from known_hosts every time the server is restarted.

koriban · 08-31-2008, 12:13 PM

Solved: The host key checking was actually supressed but Nagio's check_by_ssh command got confused by the Warning message that ssh still emitted when it encountered the key mismatch. This could be solved by passing the -q option to check_by_ssh.