4 ms·

> StrictHostKeyChecking=no And welcome to MITM haven. This is awful advice if you care about the first S in SSH.

by cmrx64 11y ago

Karunamon 11y ago
Depends on your circumstances, really. If you're in an environment with lots of VM's floating around, being created, destroyed, and so on, dealing with SSH's paranoia (why can't I just dismiss a warning about a host/key mismatch instead of having to edit .known_hosts?) quickly becomes an exercise in frustration for dubious security benefit. (If the enemy is on your LAN and able to manipulate your DNS, you've already lost) On your home box, sure. But let's not pretend there's not a reason for the option to exist.
- richardwhiuk 11y ago
  In which case, just use telnet. Seriously.
- DDub 11y ago
  I use an alias to select when to, and not to, use host keys; alias ssht='ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' ssht floaty.vm # does not use host key checking ssh my.bastion.host # validates host key Really I ought to get SSHFP records populated when my vm's are created...
- jamespo 11y ago
  In these environments you can use server certificates https://www.digitalocean.com/community/tutorials/how-to-create-an-ssh-ca-to-validate-hosts-and-clients-with-ubuntu https://www.digitalocean.com/community/tutorials/how-to-crea...
AYBABTME 11y ago
What would be good is an interactive confirmation when a host fingerprint has changed, instead of a flatout abortion and having to edit your `known_host` file. I have to SSH into hundreds/thousands of VM that reuse the same IPs/FQDN sometimes, and the strict host checking is a major PITA. I haven't turned it off tho, I prefer the pain to MITM.
- voltagex_ 11y ago
  I wonder if SSHFP records on Avahi/mDNS would work?
- xorcist 11y ago
  Don't use SSH in a trust-on-first-use configuration in that situation. There are two other modes to use. Either DNSSEC with SSHFP fingerprints, or sign your host keys with a CA key that you install on all your machines. A decent configuration management tool could also keep known_hosts up to date, but it tends not to be worth the trouble. Do the above first.

> StrictHostKeyChecking=no And welcome to MITM haven. This is awful advice if you care about the first S in SSH.

by cmrx64 11y ago

> StrictHostKeyChecking=no And welcome to MITM haven. This is awful advice if you care about the first S in SSH.

Depends on your circumstances, really. If you're in an environment with lots of VM's floating around, being created, destroyed, and so on, dealing with SSH's paranoia (why can't I just dismiss a warning about a host/key mismatch instead of having to edit .known_hosts?) quickly becomes an exercise in frustration for dubious security benefit. (If the enemy is on your LAN and able to manipulate your DNS, you've already lost) On your home box, sure. But let's not pretend there's not a reason for the option to exist.

richardwhiuk 11y ago
In which case, just use telnet. Seriously.
DDub 11y ago
I use an alias to select when to, and not to, use host keys; alias ssht='ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' ssht floaty.vm # does not use host key checking ssh my.bastion.host # validates host key Really I ought to get SSHFP records populated when my vm's are created...
jamespo 11y ago
In these environments you can use server certificates https://www.digitalocean.com/community/tutorials/how-to-create-an-ssh-ca-to-validate-hosts-and-clients-with-ubuntu https://www.digitalocean.com/community/tutorials/how-to-crea...

AYBABTME 11y ago

What would be good is an interactive confirmation when a host fingerprint has changed, instead of a flatout abortion and having to edit your `known_host` file. I have to SSH into hundreds/thousands of VM that reuse the same IPs/FQDN sometimes, and the strict host checking is a major PITA. I haven't turned it off tho, I prefer the pain to MITM.

voltagex_ 11y ago
I wonder if SSHFP records on Avahi/mDNS would work?
xorcist 11y ago
Don't use SSH in a trust-on-first-use configuration in that situation. There are two other modes to use. Either DNSSEC with SSHFP fingerprints, or sign your host keys with a CA key that you install on all your machines. A decent configuration management tool could also keep known_hosts up to date, but it tends not to be worth the trouble. Do the above first.