Just to get this out in front so I am not told not to do this:
- The machines in question are all on a local network with little to no internet access (they aren't even well connected to the corporate network)
- Everyone who has the ability to setup a man-in-the-middle attack already has root on the machine
- The machines are reinstalled as part of QA procedures, so having new host keys is important (we need to see how the other machines react); I am only trying to make my machine nicer to use.
I do a lot of reinstalls on machines which changes their host keys. This necessitates going into
~/.ssh/known_hosts on my machine and blowing away to old key and adding the new key. This is a massive pain in the tuckus, so I have started considering ways to automate this.
I don't want to just blindly accept any host key, so patching OpenSSH to ignore host keys is out. I have considered creating a wrapper around the
ssh command the will detect the error coming back from
ssh and present me with a prompt to delete the old key or quit. I have also considered creating a daemon that would fetch the latest host key from a machine on a whitelist (there are about twenty machines that are being constantly reinstalled) and replace the old host key in
How would you automate this process?