0
We have 2 different AWS labs, with around 40 VMs in each with same hostnames in both.
Both labs are in a private subnet, so to login, we use a jumphost named bastion. This is what my config file looks like for lab 1:
Host bastion001.dev.qwerty.com
User abc
IdentityFile xyz.pem
Host <regex for hostname pattern>
User abc
IdentityFile xyz.pem
ProxyCommand ssh -W %h:%p bastion001.dev.qwerty.com
This works fine for lab 1. But I can not set up another config file let's say config_2
, because then it gives me the following error:
grimlock$ ssh -F config_2 <hostname of a Lab 2 VM>
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:GGnuaKqWJZXFQMaJJxYyUSvUY2FKlCtNxJcyB6+LZDU.
Please contact your system administrator.
Add correct host key in /Users/grimlock/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /Users/grimlock/.ssh/known_hosts:90
ECDSA host key for <hostname of a Lab 2 VM> has changed and you have requested strict checking.
Host key verification failed.
FYI, config_2
file has the following content:
Host bastion001.qa.qwerty.com
User abc
IdentityFile xyz.pem
Host <regex for hostname pattern>
User abc
IdentityFile xyz.pem
ProxyCommand ssh -W %h:%p bastion001.qa.qwerty.com
Can someone please suggest a workaround to resolve this issue? It's not fun to manually jump through bastion every time in lab 2. Changing hostnames is not an option (business requirement).
Edit:
The hostnames look like this: xyz-service001
, xyz-service002
etc. They are not FQDNs.
You rock, good sir :) – Grimlock – 2019-07-09T10:42:53.667