Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm logging into a server based on a round-robin DNS hostname -- "login.example.com" could go to any of a number of servers. Ideally, I'd like to be able to update my known_hosts file such that reaching any of the machines is possible without a warning / error, though I guess a fallback would be if there were some way to have all the servers present the same fingerprint / host key. I've seen posts like this but "pick a single static ip to login to" is not really an option. I'd like a real solution, if there is one.

share|improve this question
add comment

3 Answers 3

up vote 3 down vote accepted

If you don't need a secure way to differentiate between machines that are in the round-robin cluster, just copy the one host key to each of the machines in the cluster.

That means your SSH host key check tells you for sure that it's in the cluster, but doesn't tell you for sure which particular machine in the cluster it is. You could rely on static IP address (or the output of hostname) as the non-secure way to differentiate between machines in the cluster.

share|improve this answer
add comment

There is no really good way to do this since ssh is made to make sure that there is no risk of DNS spoofing. That said you can use this workaround:

ssh $(nslookup login.example.com | grep -v '#' | grep -m1 '^Address:' | cut -d \  -f 2)

Basically this will lookup the ip and then use the IP address instead of the hostname, this should eliminate you problems unless the servers changes IP addresses as well.

share|improve this answer
add comment

This is what I found works...

  1. delete all the existing entries for the host in ~/.ssh/known_hosts
  2. Get a complete list of IP address' the host maps to, and then foreach IP address...
ssh-keyscan -H -t rsa 10.X.X.X >> ~/.ssh/known_hosts

then you will not see a problem again... if you use the hostname with

ssh hostname.

G

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.