Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I have a script that needs to connect to the currently active head of a high-availability cluster.
Each node in the cluster has a fixed hostname and IP address.
The current head additionally has a "virtual IP". In the case of a switchover or failover, another node configures the "virtual IP" and begins acting as the head.
Can I just point my script at the virtual IP? Won't ssh complain about mismatching host keys when the cluster moves the virtual IP to a different node?
Yes, this is possible.
sshd(8) (from OpenSSH) specifies the format of known_host files (in the section SSH_KNOWN_HOSTS FILE FORMAT):
When performing host authentication, authentication is accepted if any matching line has the proper key; […]
It is permissible (but not recommended) to have several lines or different host keys for the same names. This will inevitably happen when short forms of host names from different domains are put in the file. It is possible that the files contain conflicting information; authentication is accepted if valid information can be found from either file.
Therefore you can just add the host keys of both HA heads to your ~/.ssh/known_hosts or /etc/ssh/ssh_known_hosts:
203.0.113.50 ssh-rsa AAAAB3NzaC1yc2…6Yh5sHpkyIZvXLB
203.0.113.50 ssh-rsa AAAAB3NzaC1yc2…R0RNVnMB6C4plFr
and ssh will connect to both of them without any complaints.
