SSH: Configure ssh_config to use specific key file for a specific server fingerprint

Question

I have a key based login for a server. The IP and DNS of the server can change, because it is hosted on Amazon.

Is there a way to configure the ssh client config to use the specific key file for this server only, when the fingerprint of the server matches?

In other words: Normaly servers are matched by IP or DNS in the ssh client config. I want to do this by fingerprint, becaus IP and DNS can change.

Answer 1

You can use wildcards in a Host section in ~/.ssh/config. If you use EC2's hostname to connect to your instances the following should work:

Host *.compute-1.amazonaws.com
    IdentityFile ~/.ssh/id_rsa.aws
    # If you don't want to verify host fingerprints because they change all the time
    CheckHostIP no
    StrictHostKeyChecking no
    UserKnownHostsFile /dev/null

If you use the IP addresses you'll have to find the right IP ranges and add appropriate wildcard entries to match those.

Answer 2

Try if this works for you: add to ~/.ssh/config file the following:

Host alias_for_host_you_want_to_connect
HostName real_name_for_host_you_want_to_connect
CheckHostIP no
IdentityFile /path/to/your/keyfile
#StrictHostKeyChecking no

(comment out the last line if everything else fails)