On 2/17/19 10:24 PM, sean darcy wrote: > ssh -o stricthostkeychecking=no works. > > There's no ~/.ssh/config > > grep Strict /etc/ssh/ssh_config > # StrictHostKeyChecking ask > > but it doesn't ask: > > ssh new-gateway > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! > Someone could be eavesdropping on you right now (man-in-the-middle attack)! > It is also possible that a host key has just been changed. > The fingerprint for the ECDSA key sent by the remote host is > SHA256:TylFZRyv2D0miW94XagWwZOFPPCd1PhTRscDSXZHwVw. > Please contact your system administrator. > Add correct host key in /root/.ssh/known_hosts to get rid of this message. > Offending ECDSA key in /root/.ssh/known_hosts:1 > ECDSA host key for [new-gateway]:6878 has changed and you have requested > strict checking. > Host key verification failed. > > though it reads the config file correctly: > > ssh -G new-gateway | grep strict > stricthostkeychecking ask > > I don't want to change the ECDSA host key, because sometimes that > machine is at this address. > > any help appreciated
According to the man page If this flag is set to “no” or “off”, ssh will automatically add new host keys to the user known hosts files and allow connections to hosts with changed hostkeys to proceed, subject to some restrictions. Need to so some more research to determine what those "restrictions" are. One thing to try would be to also add CheckHostIP=no CheckHostIP If set to yes (the default), ssh(1) will additionally check the host IP address in the known_hosts file. This allows it to detect if a host key changed due to DNS spoofing and will add addresses of destination hosts to ~/.ssh/known_hosts in the process, regardless of the setting of StrictHostKeyChecking. If the option is set to no, the check will not be executed. -- Right: I dislike the default color scheme Wrong: What idiot picked the default color scheme _______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-le...@lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org
