This question already has an answer here:

I log in to the rhel5 machines at my school from home via ssh and it automatically sends me to the computer with the least load. So ssh -Y itsme@myShcool.edu will send me to either mySchoolA.edu mySchoolB.edu, or mySchoolC.edu. I can log into the individual computers with no issue but when, but when I use itsme@myShcool.edu , sometimes I get a message about a man-in-the-middle attack and possible DNS spoofing, and I'm directed to ~/.ssh/known_hosts to remove the offending key. Removing the offending key works the first time I log in (I'm prompted to add the host to known_hosts, which I confirm).

Is it possible to log in using itsme@myShcool.edu and not get this message nor have to manually remove the offending keys each time?

One thing I tried that doesn't seem to work is adding the following to ~/.ssh/config

Host hostIPaddress
StrictHostKeyChecking no 

Any help would be much appreciated.

marked as duplicate by soandos, Kevin Panko, Raystafarian, harrymc, Heptite May 26 '14 at 0:40

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    If the machines are all being accessed via the same hostname, they should have the same key. I would recommend talking to the system administrator and have him synchronize the keys across machines. – heavyd May 20 '14 at 14:42
  • @heavyd I'll see if I can talk to the sys admin about synchronizing the host key. Thanks for the help advice. – Jamie May 20 '14 at 20:31
  • @ssnobody I don't think that the post you linked is the same issue. They were having trouble editing known_hosts while keeping hashes. I'm having an issue with different machines accessed via the same hostname and apparently not having the same key. Thanks for the help though. – Jamie May 20 '14 at 20:32
  • Looks like the same issue to me. – Kevin Panko May 23 '14 at 2:34

No. That is a security feature of SSH to know you've connected to the right machine and your connection is not being intercepted. You certainly don't want to short-circuit that, it would allow a real man-in-the-middle attack and you'd never know it.

If this is how your school's IT administrator meant for this to work -- round-robin a cluster of machines with the same DNS name -- he/she would have copied the SSH private identity key to all the machines in the cluster so this authentication problem doesn't occur.

Not the answer you're looking for? Browse other questions tagged or ask your own question.