You can scan remote host new public key before login with
ssh-keygen -R x.x.x.x
ssh-keyscan x.x.x.x >> ~/.ssh/known_hosts
Then you can make a script from that, using the host as an argument and put it in your
To check if public keys differ you can do this :
diff -q <(ssh-keygen -F x.x.x.x | sed '1d') <(ssh-keyscan x.x.x.x 2>/dev/null)
Now, if you have a DNS server in your infrastructure, you should set up SSHFP DNS records to handle your machine's public key changes a centralized way and avoid the hassle of homemade scripts everywhere.
Retrieve DNS entries to configure :
ssh-keygen -r /etc/ssh/ssh_host_key.pub
The result will look like :
IN SSHFP 1 1 d3fa9bcf2d51979c53bcac2961f38b60e4e60886
IN SSHFP 2 1 f1f09814dd79eea523f490808cf3c096f1d1a432
Little explanation :
- First field : IN = Internet class
- Second field : SSHFP record type
- Third field : Algorithm (1=RSA, 2=DSA, 3=ECDSA)
- Fourth field : Fingerprint type (1=SHA-1, 2=SHA256)
Prefix these records with the server name and put them in your DNS configuration.
Then make sure all your machines will contact your DNS server in
VerifyHostKeyDNS=yes option in
.ssh/config file on each server.