Can I use ssh host key verification with a round-robin DNS?

Question

I'm logging into a server based on a round-robin DNS hostname -- "login.example.com" could go to any of a number of servers. Ideally, I'd like to be able to update my known_hosts file such that reaching any of the machines is possible without a warning / error, though I guess a fallback would be if there were some way to have all the servers present the same fingerprint / host key. I've seen posts like this but "pick a single static ip to login to" is not really an option. I'd like a real solution, if there is one.

Answer 1

If you don't need a secure way to differentiate between machines that are in the round-robin cluster, just copy the one host key to each of the machines in the cluster.

That means your SSH host key check tells you for sure that it's in the cluster, but doesn't tell you for sure which particular machine in the cluster it is. You could rely on static IP address (or the output of hostname) as the non-secure way to differentiate between machines in the cluster.

Answer 2

There is no really good way to do this since ssh is made to make sure that there is no risk of DNS spoofing. That said you can use this workaround:

ssh $(nslookup login.example.com | grep -v '#' | grep -m1 '^Address:' | cut -d \  -f 2)

Basically this will lookup the ip and then use the IP address instead of the hostname, this should eliminate you problems unless the servers changes IP addresses as well.