Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I need to connect to a host with a dynamic IP address.

Every time its IP changes, SSH prompts me the fingerprint validation thing:

The authenticity of host '...' can't be established.
RSA key fingerprint is ....
Are you sure you want to continue connecting (yes/no)?

Would it be possible to pass SSH the host public key, so that:

  1. SSH validates the host's authenticity automatically
  2. The host key is not stored in the known_hosts file

This question differs from How can I avoid SSH's host verification for known hosts? since that other questions aims to suppress SSH validation, while I do not want to suppress it: I do want to have the host authenticated, just using the host's public key (which I know, and have it stored in a file) rather than SSH known_hosts file.

To me the other question seems to be about connecting to a different server every time, rather than connecting to a single well-known server with a dynamic IP.

share|improve this question
add comment

2 Answers

The known_hosts file is not just the key, it also contains the hostname you use to connect, and if possible the IP that corresponds. Which is why you see the error, it is comparing the triplet it gets from the server with what you stored in the known_hosts file.

So, if the IP keeps changing, you could disable CheckHostIP and that means it will just check the hostname and host key. If those remain unaltered, you should have less complaints, but you will be at risk if someone hijacks your DNS.

share|improve this answer
    
Thanks for the answer, I'll test it asap! Why would it be at rist anyway? If I know a host's SSH public key, that should be enough to be totally safe in any case (unless somebody manages to steal that host's private key), shouldn't it? –  peoro Jun 8 '13 at 15:33
    
And still I don't really like it if I have to be honest. Using that flag SSH will still access known_hosts. Why? Cannot I say "ssh connect to X whose public key is Y"? Why not? Wouldn't that be 100% sure. –  peoro Jun 8 '13 at 15:41
    
The idea is that the host key is part of a larger whole, and that alone is not enough guarantee to be sure the server you are connecting to is still the one you connected to earlier. You need to be sure the IP, and DNS entries match as well.. remember, this is a network based shell, so the network needs to be checked as well. –  NickW Jun 10 '13 at 8:29
add comment

The best solution (ie. closest to what I want) I could find is to use the option HostKeyAlias: it will use an hostname I specify to access known_hosts (rather than the IP I'm connecting to).

I will need to add the host's public key to known_hosts using a given hostname (eg: myhost) and then connect to it using:

ssh -o 'HostKeyAlias myhost' ...
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.