4 ms·
What would be good is an interactive confirmation when a host fingerprint has changed, instead of a flatout abortion and having to edit your `known_host` file.
by AYBABTME 11y ago
What would be good is an interactive confirmation when a host fingerprint has changed, instead of a flatout abortion and having to edit your `known_host` file. I have to SSH into hundreds/thousands of VM that reuse the same IPs/FQDN sometimes, and the strict host checking is a major PITA. I haven't turned it off tho, I prefer the pain to MITM.
- voltagex_ 11y agoI wonder if SSHFP records on Avahi/mDNS would work?
- xorcist 11y agoDon't use SSH in a trust-on-first-use configuration in that situation. There are two other modes to use. Either DNSSEC with SSHFP fingerprints, or sign your host keys with a CA key that you install on all your machines. A decent configuration management tool could also keep known_hosts up to date, but it tends not to be worth the trouble. Do the above first.