Inside a bash script doing an ssh, automatically add the host only for certain known RSA keys

Question

I have a Chron job running a bash script that then SSH's to a my server. But my server's IP address changes from time to time (my bash script has a way of finding looking up the new IP address). But the problem is that then my bash script gets the "Authenticity of host can't be established ..." warning. I don't want to use StrictHostKeyChecking=no because of man-in-the-middle attacks. However:

If the RSA key is identical to e.g. an RSA key already in the known_host file, or an RSA key that I've saved off in some other MyServersPublicKey file, then I assume it's my server and it just has a new IP.

The warning itself displays the fingerprint of the RSA key from the "unknown" host, not the RSA key itself. I suppose I could save off the RSA key fingerprint of my host and then have my bash script consume the fingerprint from the warning and compare it to the saved off fingerprint. But I'm wondering if anyone knows an easier way.

Do I have to write my own bash script for this, or is there something available?

Answer 1

As noted in comments, creating certificates (signed host keys) would help you to solve this issue (see manual page for ssh-keygen, chapter "Certificates" describing this procedure). Basically you would create a CA on server, sign the host keys and store the CA public key in your known_hosts such as:

@cert-authority * ssh-rsa AAAAB5W...

The other possibility would be to write up some bash script, which would add your IP in front of the host key in known_hosts (if you don't have hashed that file). Something like that should work:

sed -i -e "s/your_host/new_ip,your_host/" ~/.ssh/known_hosts