5

I'm attempting to ssh to a remote host:

ssh host.example.com

I get the following:

The authenticity of host 'host.example.com (<no hostip for proxy command>)' can't be established.
RSA key fingerprint is 62:db:31:0b:ce:e3:7b:a1:c7:0f:46:d1:7d:e5:48:10.
Are you sure you want to continue connecting (yes/no)? no 
Host key verification failed.

I am using an ssh config in ~/.ssh/config:

Host host.example.com
User deployuser
HostName host.example.com
IdentityFile ~/.ssh/deployuser_key

The host is listed in /etc/ssh/ssh_known_hosts and the fingerprint matches. There is no entry in ~/.ssh/known_hosts.

If I accept the key, it is added to ~/.ssh/known_hosts. I am not sure what the no hostip for proxy command indicates and I would like to understand what is causing the problem.

When I run the ssh command with -vvv I can see that ssh is checking /var/lib/sss/pubconf/known_hosts and not /etc/ssh/ssh_known_hosts -- which I believe explains the unexpected behavior (if not the warning message). Once I added the host key to /var/lib/sss/pubconf/known_hosts (via FreeIPA), the connection proceeded without warnings or prompts.

Improve this question

2 Answers 2

Reset to default
4

I am not sure what the no hostip for proxy command indicates and I would like to understand what is causing the problem.

When you connect to an SSH server without a proxy the IP address of the server is saved and stored into your known hosts file. When you are using a proxy, the client never gets the remote IP. The unhashed version of the known_hosts entry might look like this for a client not using a proxy.

srv-01,10.99.4.29 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMOZnp2wcVBSp8ddLuXFrpD8YJGOQ8MzPihHr09qkGS

It isn't an 'error', and barely even a useful warning. You can safely just ignore it.

I believe you can suppress the 'warning' by setting the CheckHostIP no option in addition to ProxyCommand. This option basically tells ssh to skip the storing/checking of the IP of the remote.

From what I am told setting this option really doesn't have any security impacts.

Improve this answer
4
  • Does the message indicate that I am using a proxy? I'm not using a proxy that I am aware of.
    – cherdt
    Apr 7, 2017 at 14:14
  • I do not get the same warning message when attempting to connect to other hosts. I still get the The authenticity of host 'host2.example.com can't be established message, but without the no hostip for proxy command
    – cherdt
    Apr 7, 2017 at 14:23
  • It turns out, I am using a proxy. The following lines, presumably added by FreeIPA, are in my /etc/ssh/ssh_config: GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
    – cherdt
    Jun 15, 2018 at 22:02
  • According to the entry for ProxyCommand in linux.die.net/man/5/ssh_config: "Note that CheckHostIP is not available for connects with a proxy command."
    – kbro
    Aug 5, 2019 at 9:26
-1

Adding these options to ProxyCommand helped me: -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null

Improve this answer
1
  • 1
    Neither of those options will have any effect on the problem described in the question, and they're both potentially quite dangerous to use if you don't know exactly what you're doing.
    – womble ♦
    Aug 30, 2018 at 2:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.