Circumventing "Remote Host Identification Has Changed" warning

Question

I'm connecting to a lot of devices that uses the same IP addresses. When I'm plugging them into the router I'm getting the warning message REMOTE HOST IDENTIFICATION HAS CHANGED! and need to run ssh-keygen -f "/home/xxx/.ssh/known_hosts" -R "xx.xx.xx.xx" if I still want to connect with the remote host.

My current strategy:

1. I want to create a shortened command from: ssh-keygen -f "/home/xxx/.ssh/known_hosts" -R "xx.xx.xx.xx"
2. You can do it from any user.
3. It should be a single command. (So I can copy paste a single line into other terminals in case I have not set it up in .bash_profile.
4. The xx.xx.xx.xx needs to be configurable.

Since you cannot provide an argument to alias (at least I think so) I tried solving it with read:

$ alias ssh-keyrm='read LAST_SSH_IP_ADDRESS_CLEARED && ssh-keygen -f "$HOME/.ssh/known_hosts" -R "$LAST_SSH_IP_ADDRESS_CLEARED"'
$ ssh-keyrm
xx.xx.xx.xx

Any advice on how I can optimize it further?

Answer 1

Another solution to prevent the host key from being saved in the first place

Please note that this will disable part of what makes ssh secure, the verification that the host you are connecting to is in fact the host you think it is!

Add a section to ~/.ssh/config

host 192.168.*.*
    StrictHostkeyChecking no
    UserKnownHostsFile /dev/null

Answer 2

If you want to pass arguments to a something pre-defined in Bash, you could use a function instead of an alias to the same effect:

ssh-keyrm() { ssh-keygen -f "$HOME/.ssh/known_hosts" -R "$1"; }

Which would be run as such:

$ ssh-keyrm 127.0.0.1

Like aliases, functions can be stored in .bashrc, .bash_profile, or defined inlne in a shell.

Answer 3

you cannot provide an argument to alias

Bash aliases work as simple expansions (the alias name just gets replaced with the alias value), so they cannot reference individual arguments using $n.

However, you can provide arguments as long as they go at the end of the command. With an alias like this:

alias rmh="ssh-keygen -f ~/.ssh/known_hosts -R"

you can run it as rmh 192.168.0.1 and although the word rmh will be expanded, all arguments following it will still remain in the same place.

Answer 4

I have a similar problem with different devices using the same IP, but took a slightly different approach to solve it: prevent the host keys from going in to known_hosts in the first place.

alias sshn='ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'

Then run sshn whenever you want to disable host key security.

$ sshn user@192.168.1.1
Warning: Permanently added '192.168.1.1' (ECDSA) to the list of known hosts.

user@192.168.1.1's password:

ssh tells you it added the host to the known hosts, but it didn't actually since the write went to /dev/null. You can suppress this by fiddling with the logging level, but that may turn off other useful messages.

I also have StrictHostKeyChecking=no so that it skips the authenticity prompt, but if you'd prefer to see the key fingerprint, you can omit that option.