Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 2 down vote favorite
2

Is it possible to make the ssh client not care what IP a ssh server is behind (and if a different server was behind that IP earlier) but instead trust specific server keys? (And maybe nickname those keys?) I use dynamic DNS and I have IPv6 privacy extensions enabled on some computers and am always getting asked if it think it's safe to connect. Another possibility is addresses assigned by DHCP getting assigned to different ssh servers and causing all sorts of 'key doesn't match IP' errors.

share|improve this question
I should have probably also mentioned that I have a list of public keys for each of my ssh server on a webpage that is served over SSL, so I have an easy way to check if I actually trust a specific server key set. – Azendale Jun 14 '11 at 5:51

2 Answers

up vote 1 down vote accepted

Add a nickname for your server in ~/.ssh/config, and turn off CheckHostIP for this server.

Host nickname
HostName example.dyndns.org
CheckHostIP no

Before you connect to the first time, you can copy the public key out-of-band: grab /etc/ssh/ssh_host_rsa_key.pub from the server, remove the root@hostname part at the end of the line, add example.dyndns.org at the beginning, and append the line to ~/.ssh/known_hosts. Optionally run ssh-keygen -H to hash the host name (this is only useful if you're concerned about the privacy of that entry if someone steals your hard disk or your backups, which for 99.99% of people is useless because the information is present in some other nearby location anyway).

share|improve this answer
With the Host nickname, does that mean I can just do ssh nickname so get to it? If so, that's pretty neat. – Azendale Jun 14 '11 at 6:11
@Azendale: Exactly, that's a general feature to give a nickname to a host name and a set of options (user name, boolean options, tunnels, …). – Gilles Jun 14 '11 at 8:35
up vote 1 down vote

In /etc/ssh/ssh_config add the line

CheckHostIP no

However, this takes away a bit of the Secure in SSH, because any machine can hide behind the IP or DynDNS name you connect to.

share|improve this answer
This doesn't take away any security at all. The whole point of storing the host key is to identify the other computer. The name and IP address are not relevant for security when you have the host key. Removing the spurious messages is in fact a gain for security (spurious messages consume your attention, which is a scarce resource). – Gilles Jun 12 '11 at 10:14
@Gilles: The manpage disagrees. Yes, you do not lose any security for connections where there is no well-known IP-to-host relation, in other cases you give up protection against DNS spoofing attacks (as stated in the manpage). – htorque Jun 12 '11 at 11:28
I don't know what passage in the man page you're referring to. If it's the description of CheckHostIP, then no, it doesn't say you give up any protection. With CheckHostIP no, the spoofer still has to obtain the server's private key, and if she can do that, it's unlikely that she can't also spoof its IP address anyway. – Gilles Jun 12 '11 at 11:56
Can you give me an example of how DNS spoofing would be dangerous if I know I trust the key? I use public key authentication to login, which makes it so a malicious server couldn't get a password, but what if I used passwords? – Azendale Jun 14 '11 at 6:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.