Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to connect to a host with a dynamic IP address.

Every time its IP changes, SSH prompts me the fingerprint validation thing:

The authenticity of host '...' can't be established.
RSA key fingerprint is ....
Are you sure you want to continue connecting (yes/no)?

Would it be possible to pass SSH the host public key, so that:

  1. SSH validates the host's authenticity automatically
  2. The host key is not stored in the known_hosts file

This question differs from How can I avoid SSH's host verification for known hosts? since that other questions aims to suppress SSH validation, while I do not want to suppress it: I do want to have the host authenticated, just using the host's public key (which I know, and have it stored in a file) rather than SSH known_hosts file.

To me the other question seems to be about connecting to a different server every time, rather than connecting to a single well-known server with a dynamic IP.

share|improve this question
up vote 3 down vote accepted

The best solution (ie. closest to what I want) I could find is to use the option HostKeyAlias: it will use an hostname I specify to access known_hosts (rather than the IP I'm connecting to).

I will need to add the host's public key to known_hosts using a given hostname (eg: myhost) and then connect to it using:

ssh -o 'HostKeyAlias myhost' ...
share|improve this answer
I know it's been a while, but: if this best answers your question, please accept it. – kittykittybangbang Jul 27 '15 at 13:38

The known_hosts file is not just the key, it also contains the hostname you use to connect, and if possible the IP that corresponds. Which is why you see the error, it is comparing the triplet it gets from the server with what you stored in the known_hosts file.

So, if the IP keeps changing, you could disable CheckHostIP and that means it will just check the hostname and host key. If those remain unaltered, you should have less complaints, but you will be at risk if someone hijacks your DNS.

share|improve this answer
Thanks for the answer, I'll test it asap! Why would it be at rist anyway? If I know a host's SSH public key, that should be enough to be totally safe in any case (unless somebody manages to steal that host's private key), shouldn't it? – peoro Jun 8 '13 at 15:33
And still I don't really like it if I have to be honest. Using that flag SSH will still access known_hosts. Why? Cannot I say "ssh connect to X whose public key is Y"? Why not? Wouldn't that be 100% sure. – peoro Jun 8 '13 at 15:41
The idea is that the host key is part of a larger whole, and that alone is not enough guarantee to be sure the server you are connecting to is still the one you connected to earlier. You need to be sure the IP, and DNS entries match as well.. remember, this is a network based shell, so the network needs to be checked as well. – NickW Jun 10 '13 at 8:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .