0

We have a setup as below

BigIP fqdn : app1.bu.company.com

3 redhat servers are under this bigip fqdn

dbsrv01 dbsrv02 dbsrv03

When we ssh app1.bu.company.com, it randomly connects to any of the servers underneath it in roundrobin fashion.

hostkey fingerprint is added to known_hosts of the first server it ssh to (eg. dbsrv01) and login fine.

app1.bu.company.com ssh-rsa hostkey_of_dbsrv01

in next ssh attemps, when bigip tries differnt server (eg. dbsrv03) , the hostkey gets mismatch and ssh fails.

Host key verification failed.

Is there any mechanism for this to establish the ssh connection what ever server the BigIP connects.

1
  • If I remember correctly, at job-1 I've setup the HTTPS and sticky sessions with certificates directly on BIG-IP but for ssh login's I've always used the direct access to servers which needs to open the SSH port through the FW.
    – admstg
    Apr 7, 2023 at 14:27

2 Answers 2

2

I doubt this is a best practice. I didn't thought about sftp/scp.

private keys used by system are located in /etc/ssh and are named ssh_host_XXX_key, you can try to copy from one server to other two. (you must restart sshd after copy)

2
  • This is a stable setup, and application teams use the BIG-IP fqdn for load balance. now they are trying lftp to this fqdn for data transfer. it works when the hostkey matches the underneath server, and fails when it connects to different server # lftp -p 22 -u user,password sftp://app1.bu.company.com
    – Sharma
    Apr 7, 2023 at 15:03
  • 1
    Perfectly acceptable practice for this scenario Apr 7, 2023 at 15:10
0

Set up three different access ports on the public side of the BigIP. Route each one to a specific server's ssh service.

Or just forward through one of the servers instead of round-robining all three. (I assume you're really using the BigIP for something heavy duty such as web traffic?)

3
  • is there any option with SFTP command to prompt or update known_hosts automatically when the hostkey is changed ?
    – Sharma
    Apr 7, 2023 at 16:07
  • @Sharma this might help: askubuntu.com/questions/123072/ssh-automatically-accept-keys
    – RonJohn
    Apr 7, 2023 at 16:09
  • @Sharma the whole point of the ssh key check is to prevent and flag unexpected key change. If you bypass that you've defeated a chunk of the ssh security design Apr 7, 2023 at 18:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .