2

I have a Chron job running a bash script that then SSH's to a my server. But my server's IP address changes from time to time (my bash script has a way of finding looking up the new IP address). But the problem is that then my bash script gets the "Authenticity of host can't be established ..." warning. I don't want to use StrictHostKeyChecking=no because of man-in-the-middle attacks. However:

If the RSA key is identical to e.g. an RSA key already in the known_host file, or an RSA key that I've saved off in some other MyServersPublicKey file, then I assume it's my server and it just has a new IP.

The warning itself displays the fingerprint of the RSA key from the "unknown" host, not the RSA key itself. I suppose I could save off the RSA key fingerprint of my host and then have my bash script consume the fingerprint from the warning and compare it to the saved off fingerprint. But I'm wondering if anyone knows an easier way.

Do I have to write my own bash script for this, or is there something available?

2
  • I can't check right now, but maybe signing the host key can be helpful. (Having a new IP with the same key is not the critical part, you just get the fingerprint warning, right? It's having a new host key that is cause for concern.) Commented Feb 11, 2016 at 14:55
  • Well this is operation is automated in a chron-job, so my bash script gets the fingerprint warning, not me. I need my bash script to decide if it's safe to log on or not. If it's the same old RSA key, just with a new IP address, then it's safe. If it's a different RSA key and a different IP address, well then I'd rather the chron job aborted the operation.
    – Joe C
    Commented Feb 11, 2016 at 17:29

1 Answer 1

1

As noted in comments, creating certificates (signed host keys) would help you to solve this issue (see manual page for ssh-keygen, chapter "Certificates" describing this procedure). Basically you would create a CA on server, sign the host keys and store the CA public key in your known_hosts such as:

@cert-authority * ssh-rsa AAAAB5W...

The other possibility would be to write up some bash script, which would add your IP in front of the host key in known_hosts (if you don't have hashed that file). Something like that should work:

sed -i -e "s/your_host/new_ip,your_host/" ~/.ssh/known_hosts

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .