I've set up a few headless Raspberry Pi systems using a Raspbian system image lately. They default to using the zeroconf domain name raspberrypi.local
. Before I can change it, I have to connect to the new server with SSH, which always barks at me:
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> @ WARNING: POSSIBLE DNS SPOOFING DETECTED! @
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
and won't connect until I open the known_hosts file and delete the previous entry. Then when it does connect, it automatically adds a new entry for raspberrypi.local
to mess things up next time.
I understand and appreciate the logic of checking the keys and automatically adding new ones, but I think for this specific case it doesn't make sense. I would never be connecting to a server called raspberrypi.local
unless it was a new server I just plugged in, and in that case it will never have a known trustworthy key.
I can see from the known_hosts specification that I can set a wildcard on the address side (ie. accept this key from any address in this range) but what I want to do is set a wildcard on the key side (accept any key from this particular domain name). Or better yet, just don't check keys from this domain name at all.
Is there any way to tell known_hosts to ignore (pass without checking keys from) a single specific domain name?