4

I'm logging into a server based on a round-robin DNS hostname -- "login.example.com" could go to any of a number of servers. Ideally, I'd like to be able to update my known_hosts file such that reaching any of the machines is possible without a warning / error, though I guess a fallback would be if there were some way to have all the servers present the same fingerprint / host key. I've seen posts like this but "pick a single static ip to login to" is not really an option. I'd like a real solution, if there is one.

3 Answers 3

5

If you don't need a secure way to differentiate between machines that are in the round-robin cluster, just copy the one host key to each of the machines in the cluster.

That means your SSH host key check tells you for sure that it's in the cluster, but doesn't tell you for sure which particular machine in the cluster it is. You could rely on static IP address (or the output of hostname) as the non-secure way to differentiate between machines in the cluster.

3

There is no really good way to do this since ssh is made to make sure that there is no risk of DNS spoofing. That said you can use this workaround:

ssh $(nslookup login.example.com | grep -v '#' | grep -m1 '^Address:' | cut -d \  -f 2)

Basically this will lookup the ip and then use the IP address instead of the hostname, this should eliminate you problems unless the servers changes IP addresses as well.

1

This is what I found works...

  1. delete all the existing entries for the host in ~/.ssh/known_hosts
  2. Get a complete list of IP address' the host maps to, and then foreach IP address...
ssh-keyscan -H -t rsa 10.X.X.X >> ~/.ssh/known_hosts

then you will not see a problem again... if you use the hostname with

ssh hostname.

G

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .