8

I'm connecting to a lot of devices that uses the same IP addresses. When I'm plugging them into the router I'm getting the warning message REMOTE HOST IDENTIFICATION HAS CHANGED! and need to run ssh-keygen -f "/home/xxx/.ssh/known_hosts" -R "xx.xx.xx.xx" if I still want to connect with the remote host.

My current strategy:

  1. I want to create a shortened command from: ssh-keygen -f "/home/xxx/.ssh/known_hosts" -R "xx.xx.xx.xx"
  2. You can do it from any user.
  3. It should be a single command. (So I can copy paste a single line into other terminals in case I have not set it up in .bash_profile.
  4. The xx.xx.xx.xx needs to be configurable.

Since you cannot provide an argument to alias (at least I think so) I tried solving it with read:

$ alias ssh-keyrm='read LAST_SSH_IP_ADDRESS_CLEARED && ssh-keygen -f "$HOME/.ssh/known_hosts" -R "$LAST_SSH_IP_ADDRESS_CLEARED"'
$ ssh-keyrm
xx.xx.xx.xx

Any advice on how I can optimize it further?

Improve this question
1
  • 6
    Just as a tangential warning, note that doing this (by any of the means described on this page) means disabling a core part of the SSH security model. It can be OK to do so if, like in your case, you can verify via other means that the host you're connecting to really is the one you expect and trust, but this is not a trick that should be blindly imitated by others just to get rid of annoying error messages. Also, just in case, I would strongly recommend using public key authentication if you do this (or even if you don't, really) to protect against malicious or compromised hosts. – Ilmari Karonen Mar 6 '20 at 12:21
8

Another solution to prevent the host key from being saved in the first place

Please note that this will disable part of what makes ssh secure, the verification that the host you are connecting to is in fact the host you think it is!

Add a section to ~/.ssh/config

host 192.168.*.*
    StrictHostkeyChecking no
    UserKnownHostsFile /dev/null
Improve this answer
16

If you want to pass arguments to a something pre-defined in Bash, you could use a function instead of an alias to the same effect:

ssh-keyrm() { ssh-keygen -f "$HOME/.ssh/known_hosts" -R "$1"; }

Which would be run as such:

$ ssh-keyrm 127.0.0.1

Like aliases, functions can be stored in .bashrc, .bash_profile, or defined inlne in a shell.

Improve this answer
1
  • 4
    Note: if there is already ssh-keyrm alias then ssh-keyrm() will trigger it. The OP needs to unalias ssh-keyrm first. – Kamil Maciorowski Mar 4 '20 at 15:35
13

you cannot provide an argument to alias

Bash aliases work as simple expansions (the alias name just gets replaced with the alias value), so they cannot reference individual arguments using $n.

However, you can provide arguments as long as they go at the end of the command. With an alias like this:

alias rmh="ssh-keygen -f ~/.ssh/known_hosts -R"

you can run it as rmh 192.168.0.1 and although the word rmh will be expanded, all arguments following it will still remain in the same place.

Improve this answer
8

I have a similar problem with different devices using the same IP, but took a slightly different approach to solve it: prevent the host keys from going in to known_hosts in the first place.

alias sshn='ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'

Then run sshn whenever you want to disable host key security.

$ sshn user@192.168.1.1
Warning: Permanently added '192.168.1.1' (ECDSA) to the list of known hosts.

user@192.168.1.1's password:

ssh tells you it added the host to the known hosts, but it didn't actually since the write went to /dev/null. You can suppress this by fiddling with the logging level, but that may turn off other useful messages.

I also have StrictHostKeyChecking=no so that it skips the authenticity prompt, but if you'd prefer to see the key fingerprint, you can omit that option.

Improve this answer
3
  • 2
    In the same direction, I use the following snippet in my ~/.ssh/config host 192.168.2.* StrictHostKeyChecking no UserKnownHostsFile /dev/null – Pelle Mar 5 '20 at 12:14
  • @Pelle: You, sir, are a lifesaver. This is exactly the configuration option I always mean to look up while I'm ip-ing a lot of devices, but then always forget once I'm finished, only to be annoyed the next time. – Jörg W Mittag Mar 5 '20 at 13:55
  • Ok, I've made an answer from it, tnx for the enthusiasm :) – Pelle Mar 6 '20 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.