SSH checks its known_hosts
for all entries for this host. If all of them don't match, including the usual case of all being the single one entry, then SSH will complain.
If any of them matches SSH succeeds at host checking.
From man sshd
in SSH_KNOWN_HOSTS FILE FORMAT:
When performing host authentication, authentication is accepted if any
matching line has the proper key; either one that matches exactly or,
if the server has presented a certificate for authentication, the key
of the certification authority that signed the certificate.
[...]
It is permissible (but not recommended) to have several lines or
different host keys for the same names. This will inevitably happen
when short forms of host names from different domains are put in the
file. It is possible that the files contain conflicting information;
authentication is accepted if valid information can be found from
either file.
One (less un)common usage of this is for SSH servers often used as SFTP servers in high-availability context through a VIP: when there's a failover from one node to the other, the host authentication can change.
One can use ssh-keyscan 10.0.4.4
possibly with additional options (such as option -H
for hashing privacy) twice: once on each different VM, to retrieve all possible host keys and append them or some of them to ~/.ssh/known_hosts
.
Then no authentication error will happen anymore, until trying to access a 3rd unrelated node with the same address.