Avoid ssh authenticity test for local addresses

Question

When in the same LAN several ssh servers use DHCP, their IP address may change. Every time they have a new address (that is: an address they never had before in that LAN), the following message appears:

The authenticity of host '192.168.1.x (192.168.1.x)' can't be established.
ECDSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Are you sure you want to continue connecting (yes/no)?

If I say yes, that fingerprint will be permanently related to that address. But when a different ssh server will be 192.168.1.x, it will have a different fingerprint and a strong warning appears.

Both the server(s) and the client run Ubuntu 14.04, with the latest updates. I trust the server because I have physical access to it and even when its address has changed, I know its authenticity.

1) Is it possible that the same server periodically changes its key fingerprint?

2) Is there a way to suppress the fingerprint check only for local addresses, that is in the range 192.168.1.1-254?

Answer 1

~/.ssh/config:

host 192.168.1.*
    CheckHostIP no
    StrictHostKeyChecking no

Answer 2

1) Is it possible that the same server periodically changes its key fingerprint?

Yes, the server key(s) may in theory be changed at any time by the administrator of that server. However, that destroys established trust, so it should not be done in practice without reason.

It can occur if a server is rebuilt (new hardware without preserving ssh server keys, or nuke from orbit scenario). It can also occur if there are multiple servers with different keys which use the same hostname (behind a load balancer, for example).

In addition, ssh servers typically have multiple host keys of different types (rsa, dsa, ecdsa, ed25519...) so you may see a different key fingerprint when using one client as compared to another client, depending on what key exchange is negotiated. However, any given client should always get the same key from the server if neither client nor server configuration changes.

2) Is there a way to suppress the fingerprint check only for local addresses, that is in the range 192.168.1.1-254

Yes. From the ssh_config manual page, the options CheckHostIP and StrictHostKeyChecking affect this behaviour. To suppress these checks for all hostnames beginning "192.168.1." followed by one to three characters, use

Host 192.168.1.?,192.168.1.??,192.168.1.???
    CheckHostIP no
    StrictHostKeyChecking no

Note that the patterns supported in the Host clause are not full regular expressions or shell globs, but string matches with the single character ? and the greedy * wildcards only. Hence, if someone managed to register 1.com, then this pattern would also match the remote server 192.168.1.com.

Using the greedy glob would make a simpler configuration clause Host 192.168.1.*, but also allow matches to a wider range of mixed alpha-numeric names, such as 192.168.1.evil.qwerty.org. The chances of inadvertently connecting (without host key verification) to such a server is very low; however it is good to be aware that this is simply a string glob and not something that will necessarily be parsed as a subnet address, just because it looks somewhat like one.