Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

each user creates and destroys 15+ plus vm's per day. The vm's are created in the company's internal openstack cloud.

Every time a new vm is assigned an ip address which has previously been handed out, the user gets the dreaded host key verification failed error. This is because the ssh key does not match the ip address in the users known_hosts file.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
xxxxxxxxxxx
Please contact your system administrator.
Add correct host key in /home/user/.ssh/known_hosts to get rid of this message.
Offending key in /home/user/.ssh/known_hosts:4
RSA host key for domain.com has changed and you have requested strict checking.
Host key verification failed.

The two solutions I can see are:

  • Turn off strict checking - (Security risk)
  • Have the users run ssh-keygen -R - (users are getting tired of this solution, since then run into it multiple times per day)

Is there any way to prevent this error message, yet stay secure? perhaps turn off security checking for just a specific subnet?

share|improve this question
    
    
@MichaelHampton This is no duplicate; this question is much broader. The other one was about solving the problem for a single key. This is about handling frequent key changes. –  Hauke Laging May 10 '13 at 23:12
1  
...any reason you can't use Puppet or something equivalent to put a standard per-user key on each VM? –  voretaq7 May 11 '13 at 1:24

3 Answers 3

up vote 4 down vote accepted

The great feature HostKeyAlias solves your problem:

ssh -o HostKeyAlias=hostkeyalias__vm_2013-05-11_07 user@host

creates an entry hostkeyalias__vm_2013-05-11_07 (without IP) in known_hosts. Of course, you could write a script or shell function which sets this value before each ssh call. Or you use a shell variable:

HOSTKEYALIAS=hostkeyalias__vm_2013-05-11_07
ssh -o HostKeyAlias=$HOSTKEYALIAS user@host

and change $HOSTKEYALIAS whenever the VM is changed. From time to time the old entries should be deleted from known_hosts.

share|improve this answer

create ~/.ssh/config

with the contents: Host * StrictHostKeyChecking no

Alternately you can create an alias for ssh to: ssh -o StrictHostKeyChecking=no

share|improve this answer

You could retrieve the new host key from the VM console and update the known hosts file after an instance boots up.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.