I have two networks, each with a bastion host and a webapp host behind it. I've set up my ~/.ssh/config with ProxyCommand so I can log in to either webapp host from my local machine with just one ssh command, like this:

Host example.production

Host example.production.web
ProxyCommand ssh example.production nc %h %p 2> /dev/null

Host example.demo

Host example.demo.web
ProxyCommand ssh example.demo nc %h %p 2> /dev/null

The problem is that both webapp hosts are (in different networks), so ssh complains that the ECDSA key does not match. Is there anything I can do to indicate that these are two separate machines, with separate ECDSA keys?

1 Answer 1


One option would be to use your /etc/hosts file with alternate DNS records in it. For example; host1 host2

Then your ssh config's Hostname parameter has the respective DNS name as in the hosts file instead. ssh will see the hostname and use that for key matching instead.

Alternately you can disable strict host key checking. Put this in you ssh config under each host entry;

StrictHostKeyChecking no

which will disable the ECDSA check for them.

  • using "StrictHostKeyChecking no" it's enough
    – c4f4t0r
    Commented Jul 21, 2014 at 21:15
  • Thanks for your answer! I couldn't get the /etc/hosts approach to work. Perhaps I need to edit the file on the bastion host rather than locally? Disabling host key checking is okay, but it's not ideal, and ssh still prints an alarming warning. Commented Jul 22, 2014 at 4:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .