I have two networks, each with a bastion host and a webapp host behind it. I've set up my ~/.ssh/config with ProxyCommand so I can log in to either webapp host from my local machine with just one ssh command, like this:

Host example.production

Host example.production.web
ProxyCommand ssh example.production nc %h %p 2> /dev/null

Host example.demo

Host example.demo.web
ProxyCommand ssh example.demo nc %h %p 2> /dev/null

The problem is that both webapp hosts are (in different networks), so ssh complains that the ECDSA key does not match. Is there anything I can do to indicate that these are two separate machines, with separate ECDSA keys?


One option would be to use your /etc/hosts file with alternate DNS records in it. For example; host1 host2

Then your ssh config's Hostname parameter has the respective DNS name as in the hosts file instead. ssh will see the hostname and use that for key matching instead.

Alternately you can disable strict host key checking. Put this in you ssh config under each host entry;

StrictHostKeyChecking no

which will disable the ECDSA check for them.

| improve this answer | |
  • using "StrictHostKeyChecking no" it's enough – c4f4t0r Jul 21 '14 at 21:15
  • Thanks for your answer! I couldn't get the /etc/hosts approach to work. Perhaps I need to edit the file on the bastion host rather than locally? Disabling host key checking is okay, but it's not ideal, and ssh still prints an alarming warning. – Paul A Jungwirth Jul 22 '14 at 4:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.