2

I have a laptop and multiple networks that I visit. When I'm on network Alpha, I want to ssh 192.168.1.10, which is a webserver. When I'm on network Beta, I want to ssh 192.168.1.10, which is a file-server.

Because I'm visiting two different machines with the same IP, I get the big banner

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @ 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

But all that's really happening is that I'm on a different private network, so the context of my ssh command is different.

I know I can do ssh -o StrictHostKeyChecking=no and bypass the check, but is there a way to keep checking (hey I'd like to know if one of the hosts actually changed) but make it network-aware?

4
  • Not enough detail to offer a specific solution but some systems allow scripts to be executed when connecting to a network. For your case known_hosts could be a symlink to a per-network known_hosts file and a script would change the link upon connection to a network. – Mark Wagner Dec 24 '20 at 17:55
  • IMO, your comment is sufficient as a solution. If you named one or two such systems that could help me find similar tools, but just with the suggestion to swap known_hosts around I can see how I might write my own script. – Nathaniel Waisbrot Dec 24 '20 at 18:31
  • What detail would you need to offer a specific solution? – Nathaniel Waisbrot Dec 24 '20 at 18:32
  • E.g. for netplan and networkd-dispatcher see gitlab.com/craftyguy/networkd-dispatcher. Since the networks aren't named you'd might need to use some trickery like keying off of the mac address of the default gateway. If it is wireless, however you can use the ESSID. – Mark Wagner Dec 24 '20 at 18:50
5

Implement IPv6. Add globally unique addressees to hosts, and to DNS. Which network becomes obvious by /64 subnets.

A big project just for your administrative convenience, maybe. But it may become a bigger problem if an organization ever merges or restructures or uses VPNs, introducing address conflicts.

1
  • Mark's answer of "mess around with known_hosts is what I was looking for, but I agree that this is really the correct solution -- the point of IPv6 is to allow every host a unique address and if I had that then ssh's host verification would work exactly as intended. – Nathaniel Waisbrot Dec 25 '20 at 22:44
1

Add something like this to /etc/hosts:

192.168.1.10    alpha-webserver    beta-fileserver

Then use ssh user@alpha-webserver or ssh user@beta-fileserver.

The ssh known hosts file uses the name you give as the key, so just use 2 different names instead of 1 IP. Might be useful in other context also -- a name is always less error-prone than a number :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.