0

One of my Debian machines (all using some more-or-less recent version of OpenSSH) has got some fingerprints of remote machines in the known_hosts file. From time to time this remote machines get reinstalled and so they get a new fingerprint. When I now try to connect, I get the famous 'remote host identification has changed' error message instead of a working connection.

I already have a small script which can repair this situation. But my problem is to detect it automatically in a scripted way.

What I want to implement now is some other script, running in background at some time, which detects if a 'remote host identification has changed' situation occurred. If so, it should start my repair-script.

I already have some ideas for dirty hacks. Maybe I can parse the output for the error message. Or maybe I can try with and without host verification and trigger the event if only the latter one succeeds. But I wonder if there is a more clean way to detect that in an automated way.

Does anybody have an idea for that? Entirely turning off the host verification is not a working alternative of course. It might be that I don't see the wood for the trees currently...

  • ... it can also happen that the remote machines are turned off. I have to distingush between a changed fingerprint and other errors. It is not enough to just detect the impossibility to establish a connection. – ginger Oct 22 '15 at 23:11
0

This is a very simple script. When run, if the ssh key change, it print the name server. The file servers have the ip or names.

#!/bin/bash
rm new
while read server
do
        ssh-keyscan $server >> new  2> /dev/null
        diff new org 2> /dev/null | grep ">" | cut -d" " -f 2
        cp new org
done < servers
  • Thank you very much. I haven't tested the complete script at once, but just the ssh-keyscan path. But I see that it returns the actual remote fingerprint and I can imagine how to proceed from here. – ginger Oct 23 '15 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.