ssh possible dns spoofing when logging into multiple machines via single host

0

I log in to the rhel5 machines at my school from home via ssh and it automatically sends me to the computer with the least load. So ssh -Y itsme@myShcool.edu will send me to either mySchoolA.edu mySchoolB.edu, or mySchoolC.edu. I can log into the individual computers with no issue but when, but when I use itsme@myShcool.edu , sometimes I get a message about a man-in-the-middle attack and possible DNS spoofing, and I'm directed to ~/.ssh/known_hosts to remove the offending key. Removing the offending key works the first time I log in (I'm prompted to add the host to known_hosts, which I confirm).

Is it possible to log in using itsme@myShcool.edu and not get this message nor have to manually remove the offending keys each time?

One thing I tried that doesn't seem to work is adding the following to ~/.ssh/config

Host hostIPaddress
StrictHostKeyChecking no 
UserKnownHostsFile=/dev/null

Any help would be much appreciated.

Jamie

Posted 2014-05-20T14:29:23.157

Reputation: 101

Question was closed 2014-05-26T00:40:27.550

1If the machines are all being accessed via the same hostname, they should have the same key. I would recommend talking to the system administrator and have him synchronize the keys across machines. – heavyd – 2014-05-20T14:42:50.113

@heavyd I'll see if I can talk to the sys admin about synchronizing the host key. Thanks for the help advice. – Jamie – 2014-05-20T20:31:58.763

@ssnobody I don't think that the post you linked is the same issue. They were having trouble editing known_hosts while keeping hashes. I'm having an issue with different machines accessed via the same hostname and apparently not having the same key. Thanks for the help though. – Jamie – 2014-05-20T20:32:34.410

Looks like the same issue to me. – Kevin Panko – 2014-05-23T02:34:53.330

Answers

0

No. That is a security feature of SSH to know you've connected to the right machine and your connection is not being intercepted. You certainly don't want to short-circuit that, it would allow a real man-in-the-middle attack and you'd never know it.

If this is how your school's IT administrator meant for this to work -- round-robin a cluster of machines with the same DNS name -- he/she would have copied the SSH private identity key to all the machines in the cluster so this authentication problem doesn't occur.

milli

Posted 2014-05-20T14:29:23.157

Reputation: 1 682

Asked: 2014-05-20T14:29:23.157

Viewed: 196 times

Active: 2014-05-21T23:11:15.390