0

I noticed in place that I worked that when a linux machine (a VM actually and a service guard cluster) is patched, its SSH host key changed.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!

I know how to fix this. My question is why does this occur every time the machines get patched? The fix is quite trivial but I found this annoying even though I only have to fix it once or twice a year.

Also, is it wise to use

 ssh -o "StrictHostKeyChecking=no" 

When those 2 machines communicate?

Machine A periodically scp to/from Machine B to get certain files. My colleage says we can disable StrictHostKeyChecking as those 2 machines are in the same data center.

Also is there a way a prevent the SSH host key from changing when they get patched?

Thoughts?

  • 2
    What does "gets patched" mean with regards to this particular server? What Linux is the server running? – Kusalananda Jul 3 at 8:16
  • @ Kusalananda The servers are running in RHEL6. Patch here refers to OS patching . I'm not sure how how they patch things, I believe they are using custom packs instead of just running yum update. – Demeter P. Chen Jul 3 at 8:30
  • 4
    @DemeterP.Chen You should edit your question to add information instead of answering in a comment. Disabling the check means you have to trust that you are connected to the right machine. If you fix the problem of the changed host key without verifying the new key you have no better security. If you can't tell us more details how exactly "they patch" the system, we don't know how to prevent the host key from changing. Maybe the VM gets replaced by a fresh image which automatically generates a new key. In this case "they" would have to save the old key and copy it to the new VM. Ask "them". – Bodo Jul 3 at 8:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.