New User? Register here - Existing Users: Username: Password: [Advanced Login]

 

 

Current Poll

Your preferred Interactive shell?









( 1337 votes ~ 14 comments )

 

Weblog entry #19 for eric

See all weblog entries made by eric.

XML logo

#19
[ssh]key verification per host disabled: possible?
Posted by eric on Wed 23 Jan 2008 at 16:04
Tags: none.

Hi all,

I'm currently configuring a Xen server with several domUs, but all of them sharing a single IP address. I use xen-nat and some iptables to redirect ssh and http ports [1].

So i'm currently connecting with ssh to each domU with commands like
$ ssh root@IP -p 1022
using 1022, 1023,... redirected to each domU port 22.

The problem is ssh key verification that force me to erase my .known_hosts IP key each time i connect to a different domU.

Do you know if there is a way to disable completely this behaviour or (better) only for my IP host?
(i have alreadly checked StrictHostKeyChecking but it don't seems to work because each time it cancel the connection)

[1] check http://blog.sietch-tabr.com/index.php/post/2007/07/10/Xen-NAT for more details (in French)

[ 3 Comments | Add Comment | XML logo ]
<<< Previous Next >>>

 

Comments on this Entry

#1
Use the same keys on all domU hosts?
Posted by mwr (24.158.xx.xx) on Thu 24 Jan 2008 at 03:35
[ Send Message | View Weblogs ]
Any reason not to just use the same keys on all the hosted servers? If they're all under your control, that would be one option.

[ Parent | Reply to this comment ]

#2
Re: Use the same keys on all domU hosts?
Posted by eric (194.2.xx.xx) on Thu 24 Jan 2008 at 07:45
[ Send Message | View Weblogs ]
Oh... thanks. I didn't even thought about this possibility so used to the automatic creation of host key in Debian... shame on me :)

:eric:
http://blog.sietch-tabr.com

[ Parent | Reply to this comment ]

#3
Re: Use the same keys on all domU hosts?
Posted by dkg (216.254.xx.xx) on Mon 28 Jan 2008 at 16:33
[ Send Message | View dkg's Scratchpad | View Weblogs ]
If you use the same key on all the hosted servers, then a root compromise on any one domU could cascade into the other domU's. You probably don't want to do that.

The OP can avoid the problem for specific servers with stanzas in ~/.ssh/config. For example: 

Host foo.example.org
Hostname 1.2.3.4
Port 1004
HostKeyAlias foo
This tells ssh to just work with the line in ~/.ssh/known_hosts titled foo, and should avoid the conflicts you're seeing. It also makes it more convenient to connect, because you can just do: 
ssh foo.example.org
instead of 
ssh 1.2.3.4 -p 1004

[ Parent | Reply to this comment ]

 

 

Flattr