Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
I have two similar deployments of a web app, each on separate virtual network with private IP addresses. Both have a VM at 10.0.4.4.
I can VPN from my development machine into either network and SSH onto the VMs however when I switch networks SSH kicks up a fuss about the hosts having different keys.
Can I configure multiple key signatures against a single hostname to avoid this? What is the recommended way to connect to different machines which have the same IP?
SSH checks its known_hosts for all entries for this host. If all of them don't match, including the usual case of all being the single one entry, then SSH will complain.
If any of them matches SSH succeeds at host checking.
From man sshd in SSH_KNOWN_HOSTS FILE FORMAT:
When performing host authentication, authentication is accepted if any matching line has the proper key; either one that matches exactly or, if the server has presented a certificate for authentication, the key of the certification authority that signed the certificate.
[...]
It is permissible (but not recommended) to have several lines or different host keys for the same names. This will inevitably happen when short forms of host names from different domains are put in the file. It is possible that the files contain conflicting information; authentication is accepted if valid information can be found from either file.
One (less un)common usage of this is for SSH servers often used as SFTP servers in high-availability context through a VIP: when there's a failover from one node to the other, the host authentication can change.
One can use ssh-keyscan 10.0.4.4 possibly with additional options (such as option -H for hashing privacy) twice: once on each different VM, to retrieve all possible host keys and append them or some of them to ~/.ssh/known_hosts.
Then no authentication error will happen anymore, until trying to access a 3rd unrelated node with the same address.
You don't identify the OS of the development machine but this should work for openSSH on either Linux or Mac.
From the command line
ssh -o StrictHostKeyChecking=no 10.0.4.4
Or set up ~/.ssh/config with the lines
Host 10.0.4.4
StrictHostKeyChecking=no
If you control the VMs and they are Linux, you can copy all of the key files in /etc/ssh/ from one VM to the other and then restart sshd. This will give identical host keys.
