When in the same LAN several ssh servers use DHCP, their IP address may change. Every time they have a new address (that is: an address they never had before in that LAN), the following message appears:

The authenticity of host '192.168.1.x (192.168.1.x)' can't be established.
ECDSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Are you sure you want to continue connecting (yes/no)?

If I say yes, that fingerprint will be permanently related to that address. But when a different ssh server will be 192.168.1.x, it will have a different fingerprint and a strong warning appears.

Both the server(s) and the client run Ubuntu 14.04, with the latest updates. I trust the server because I have physical access to it and even when its address has changed, I know its authenticity.

1) Is it possible that the same server periodically changes its key fingerprint?

2) Is there a way to suppress the fingerprint check only for local addresses, that is in the range 192.168.1.1-254?

  • It is unusual for a server to change its key. They are held in /etc/ssh/, and are usually created the first time they are needed. Perhaps this directory is being cleared, or is a volatile overlayfs lost on reboot, or you are booting a fresh Linux installation each time. – meuh Sep 20 '16 at 12:28

~/.ssh/config:

host 192.168.1.*
    CheckHostIP no
    StrictHostKeyChecking no
  • 4
    Or host 192.168.1.?,192.168.1.??,192.168.1.??? if you want to be paranoid about not connecting without warning to 192.168.1.some.domain.com – user4556274 Sep 19 '16 at 21:34
  • Ok, thanks! And what about the first question? Can a server periodically change its fingerprint? – BowPark Sep 20 '16 at 10:09

1) Is it possible that the same server periodically changes its key fingerprint?

Yes, the server key(s) may in theory be changed at any time by the administrator of that server. However, that destroys established trust, so it should not be done in practice without reason.

It can occur if a server is rebuilt (new hardware without preserving ssh server keys, or nuke from orbit scenario). It can also occur if there are multiple servers with different keys which use the same hostname (behind a load balancer, for example).

In addition, ssh servers typically have multiple host keys of different types (rsa, dsa, ecdsa, ed25519...) so you may see a different key fingerprint when using one client as compared to another client, depending on what key exchange is negotiated. However, any given client should always get the same key from the server if neither client nor server configuration changes.

2) Is there a way to suppress the fingerprint check only for local addresses, that is in the range 192.168.1.1-254

Yes. From the ssh_config manual page, the options CheckHostIP and StrictHostKeyChecking affect this behaviour. To suppress these checks for all hostnames beginning "192.168.1." followed by one to three characters, use

Host 192.168.1.?,192.168.1.??,192.168.1.???
    CheckHostIP no
    StrictHostKeyChecking no

Note that the patterns supported in the Host clause are not full regular expressions or shell globs, but string matches with the single character ? and the greedy * wildcards only. Hence, if someone managed to register 1.com, then this pattern would also match the remote server 192.168.1.com.

Using the greedy glob would make a simpler configuration clause Host 192.168.1.*, but also allow matches to a wider range of mixed alpha-numeric names, such as 192.168.1.evil.qwerty.org. The chances of inadvertently connecting (without host key verification) to such a server is very low; however it is good to be aware that this is simply a string glob and not something that will necessarily be parsed as a subnet address, just because it looks somewhat like one.

  • Thank you for the detailed explanation. If you want, edit it including your previous comment on host 192.168.1.?, so it will be a complete answer. "Any given client should always get the same key from the server if neither client nor server configuration changes": is it still true when ssh client and server packages are automatically updated by Ubuntu? – BowPark Sep 20 '16 at 13:23

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.