ECDSA error ssh'ing to two proxied machines with same IP address

Question

I have two networks, each with a bastion host and a webapp host behind it. I've set up my ~/.ssh/config with ProxyCommand so I can log in to either webapp host from my local machine with just one ssh command, like this:

Host example.production
Hostname 54.0.10.1

Host example.production.web
Hostname 10.0.10.1
ProxyCommand ssh example.production nc %h %p 2> /dev/null

Host example.demo
Hostname 54.0.20.1

Host example.demo.web
Hostname 10.0.10.1
ProxyCommand ssh example.demo nc %h %p 2> /dev/null

The problem is that both webapp hosts are 10.0.10.1 (in different networks), so ssh complains that the ECDSA key does not match. Is there anything I can do to indicate that these are two separate machines, with separate ECDSA keys?

Answer 1

One option would be to use your /etc/hosts file with alternate DNS records in it. For example;

10.0.10.1 host1 10.0.10.1 host2

Then your ssh config's Hostname parameter has the respective DNS name as in the hosts file instead. ssh will see the hostname and use that for key matching instead.

Alternately you can disable strict host key checking. Put this in you ssh config under each host entry;

StrictHostKeyChecking no

which will disable the ECDSA check for them.