8

Is it possible to make the ssh client not care what IP a ssh server is behind (and if a different server was behind that IP earlier) but instead trust specific server keys? (And maybe nickname those keys?) I use dynamic DNS and I have IPv6 privacy extensions enabled on some computers and am always getting asked if it think it's safe to connect. Another possibility is addresses assigned by DHCP getting assigned to different ssh servers and causing all sorts of 'key doesn't match IP' errors.

Improve this question
1
  • I should have probably also mentioned that I have a list of public keys for each of my ssh server on a webpage that is served over SSL, so I have an easy way to check if I actually trust a specific server key set.
    – Azendale
    Jun 14, 2011 at 5:51

2 Answers 2

Reset to default
7

Add a nickname for your server in ~/.ssh/config, and turn off CheckHostIP for this server.

Host nickname
HostName example.dyndns.org
CheckHostIP no

Before you connect to the server for the first time, you can copy the public key out-of-band: grab /etc/ssh/ssh_host_rsa_key.pub from the server, remove the root@hostname part at the end of the line, add example.dyndns.org at the beginning, and append the line to ~/.ssh/known_hosts. Optionally run ssh-keygen -H to hash the host name (this is only useful if you're concerned about the privacy of that entry if someone steals your hard disk or your backups, which for 99.99% of people is useless because the information is present in some other nearby location anyway).

Improve this answer
2
  • With the Host nickname, does that mean I can just do ssh nickname so get to it? If so, that's pretty neat.
    – Azendale
    Jun 14, 2011 at 6:11
  • @Azendale: Exactly, that's a general feature to give a nickname to a host name and a set of options (user name, boolean options, tunnels, …).
    – Gilles 'SO- stop being evil'
    Jun 14, 2011 at 8:35
2

In /etc/ssh/ssh_config add the line

CheckHostIP no

However, this takes away a bit of the Secure in SSH, because any machine can hide behind the IP or DynDNS name you connect to.

Improve this answer
6
  • 1
    This doesn't take away any security at all. The whole point of storing the host key is to identify the other computer. The name and IP address are not relevant for security when you have the host key. Removing the spurious messages is in fact a gain for security (spurious messages consume your attention, which is a scarce resource).
    – Gilles 'SO- stop being evil'
    Jun 12, 2011 at 10:14
  • 1
    @Gilles: The manpage disagrees. Yes, you do not lose any security for connections where there is no well-known IP-to-host relation, in other cases you give up protection against DNS spoofing attacks (as stated in the manpage).
    – htorque
    Jun 12, 2011 at 11:28
  • I don't know what passage in the man page you're referring to. If it's the description of CheckHostIP, then no, it doesn't say you give up any protection. With CheckHostIP no, the spoofer still has to obtain the server's private key, and if she can do that, it's unlikely that she can't also spoof its IP address anyway.
    – Gilles 'SO- stop being evil'
    Jun 12, 2011 at 11:56
  • Can you give me an example of how DNS spoofing would be dangerous if I know I trust the key? I use public key authentication to login, which makes it so a malicious server couldn't get a password, but what if I used passwords?
    – Azendale
    Jun 14, 2011 at 6:03
  • Using public key authentication doesn't really protect your password, the server could MITM you and get your password when you sudo or similar.
    – remram
    Nov 1, 2015 at 23:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .