How can you SSH to an unknown host name with a known key?

Question

I have a machine that connects to a corporate network over VPN. When I connect to the VPN, it always gives me a different hostname and ip address. The hostname is always remote-[last octet of ip address]. Whenever I want to SSH into my machine, I first have to run "hostname -A" to see what the hostname is. The problem is, I don't always know what my hostname is when I need to access the computer. (If I go to where the computer is physically located to find the hostname, it defeats my need to SSH.)

Could I use SSH and try each hostname/ip in the subnet until it finds one that matches the correct key file?

---

I am using a windows laptop (also connected via vpn) with cygwin to ssh to a Ubuntu 12.04 machine. I am not sure why I get a different hostname when I connect to the vpn, but it's a corporate network, so they get to do whatever they want.

Answer 1

This is not portscan

Here we are going to use only basic ssh utilities ssh-keyscan and ssh-keygen for network connections / key conversion.

If you know server fingerprint

and want to search for it then you can do:

for x in {1..254}; do ssh-keyscan 10.0.0.$x > /tmp/ssh-scan.log 2> /dev/null; cat /tmp/ssh-scan.log; ssh-keygen -lf /tmp/ssh-scan.log | grep -v 'not a public key file' ; done

and it will print fingerprints for all hosts found. Above line will go through 10.0.0.1 - 10.0.0.254, tries to get public keys from every host and at last converts public key to fingerprint and displays it. Most common error messages are redirected to black hole found from /dev.

Or maybe search for public key

Then same thing without fingerprint converter, displays public keys for all hosts between 10.0.0.0 and 10.0.0.255:

for x in {1..254}; do ssh-keyscan 10.0.0.$x 2> /dev/null; done

Final answer, ssh seek'n'connect script

Originally posted by user229010 as comment, i've only cleaned it up :-)

for i in {1..255}; do 
    echo trying remote-$i
    ping -w 1 -c 1 remote-$i > /dev/null
    if [ $? -eq 0 ]; then
        # this is a live ip
        echo remote-$i is up
        if ssh-keyscan remote-ca$i | grep $expected_key -m1 -c > /dev/null; then
            # this is my machine
            ssh remote-$i
            exit 0
        fi
    fi
done

Answer 2

You have a few options here, listed from simplest to most complicated. Unsurprisingly this goes good, better, best.

1. Use a crontab to update a file on a remote system with your hostname at some interval.
   Create/Edit Crontab: crontab -e
   Add Crontab Entry: To create a job that updates a file every hour during the workday only on weekends use this example:
   

   00 09-18 * * 1-5 ssh [e-mail] "echo $(hostname -A) > ubuntuhost.name"

2. Use a crontab to email your hostname to yourself at some interval.
   Install Mailutils: sudo apt-get update && sudo apt-get install mailutils Note: choose 'internet connection' if propted by mailutils install, should be the first option.
   Create/Edit Crontab: crontab -e
   Add Crontab Entry: To create a job that emails you every hour during the workday only on weekends, with a subject line of the hostname, use this example:
   

   00 09-18 * * 1-5 mail -s "Ubuntu $(hostname -A)" [e-mail] < /dev/null 

3. Use the NetworkManager Dispatcher to email your current hostname whenever the connection changes.
   Put this script in /etc/NetworkManager/dispatcher.d, name it "50emailhostname"

#!/bin/sh -e
#make sure I'm executable (chmod 775)

echo "interface: $1, action: $2" >> /tmp/interface.log #debug

if [ "$1" = "eth0" ] && [ "$2" = "up" ]
then
  mail -s "Ubuntu $(hostname -A)" [e-mail] > /tmp/interface.log #debug
else
  echo "false" >> /tmp/interface.log #debug
fi

exit

Notes:

• You may need to change "eth0" in the script to "vpn0" or something depending on your client
• You may need to change "up" to "vpn-up"
• Use the debug statements to get the desired behavior!
• tail -f /tmp/interfaces.log in a separate window to see what it's doing
• Restart the network service as needed with service network-manager restart
• Comment out the debug statements when done
• You could get ip address instead of hostname with something like
  $(ifconfig | awk -F':' '/inet addr/&&!/127.0.0.1/{split($2,_," ");print _[1]}')

Answer 3

It would make much more sense to have the remote machine report its IP somewhere. For example by running a crontab thaat connects to your local machine over ssh and writes the hostname to a file. If you update your question with more details (what OS? Is your local machine accessible over the network?) I can tell you how to do this.

Anyway, to try all the IPs in the subnet, assuming you have arp installed, you can do something like this:

for ip in `arp | grep -v Add | awk '{print $1}'`; do ssh $ip; done

Answer 4

You could speed things up by exposing some service that's easily queried and no other machine is likely to have (of course SSH will also do, but checking with ssh is longer, and portscanning for ssh is understandably frowned upon).

Use a configurable port scanner to scan the whole subnet looking for that one service. The machine that has that service is the one you're looking for.

However, the best solution would be to talk with the network administrators and have the DNS update upon VPN connection.

Answer 5

If you like to bruteforce which IP is used by your ubuntu machine, OpenSSH has a tool called ssh-keyscan to scan the network for ssh host keys:

for ((a=0;a<255;a++)); do echo 198.51.100.$a; done | ssh-keyscan -f -H > ssh_id_list

You just need to know which one is your server. You can either get it directly from your server, or you can use the fact that your client stores them the first time it connects, into ~/.ssh/known_hosts :

ssh-keygen -F last_ip_you_used_to_connect -l

Then just grep ssh-keyscan with it.

---

Another possibility is to use mDNS: This is a distributed DNS solution that works well under the condition that the VPN allows multicast traffic. This is installed by default on Ubuntu desktops (if hostname -A displays yourhostname.local, it's good). If by any chance, iTunes (or any other Apple software that installs Bonjour) is installed in windows, then you can simply connect to yourhostname.local and it will work out of the box. Otherwise, if you have another Ubuntu machine laying around with a known ip address and a mDNS responder installed, just connect to it and ask it to resolve or ping yourhostname.local