On Fri, Jan 23, 2004 at 03:11:47PM -0600, Robert P. Goldman wrote:
> >>>>> "CF" == Clay Fandre <clay at fandre.com> writes:
> 
>     CF> $ man ssh_config
>     CF> [snip]
>     CF>  CheckHostIP
>     CF>       If this flag is set to ``yes'', ssh  will  additionally
>     CF>       check  the  host  IP  address  in the known_hosts file.
>     CF>       This allows ssh to detect if a host key changed due  to
>     CF>       DNS  spoofing.   If  the  option  is set to ``no'', the
>     CF>       check will not be executed.  The default is ``yes''.
> 
> I'm sorry to be dense, but I don't see how this helps.  Since the two
> machines are behind a NAT router, they both have the same IP address
> (but different RSA keys).  Right now I've set up so that the Strict
> checking is off, and that allows my connections to go through, but ssh
> still whines about it....

Two more possibilities from man ssh_config

HostKeyAlias
   Specifies an alias that should be used instead of the real
host name when looking up or saving the host key in the host key
database files.  This option is useful for tunneling ssh connec-
tions or for multiple servers running on a single host.


 ProxyCommand
   Specifies the command to use to connect to the server.  The
command string extends to the end of the line, and is executed
with /bin/sh.  In the command string, '%h' will be substituted by
the host name to connect and '%p' by the port.  The command can
be basically anything, and should read from its standard input
and write to its standard output.  It should eventually connect
an sshd(8) server running on some machine, or execute sshd -i
somewhere.  Host key management will be done using the HostName
of the host being connected (defaulting to the name typed by the
user).  Setting the command to ``none'' disables this option
entirely.  Note that CheckHostIP is not available for connects
with a proxy command.


It seems to me that HostKeyAlias should do want, but I have never
actually used it.  If not Proxycommand should simplify a way to
kludge it.

-- 
Jim Crumley                  |Twin Cities Linux Users Group Mailing List (TCLUG)
crumley at fields.space.umn.edu |Minneapolis/St. Paul, Minnesota 
Ruthless Debian Zealot       |http://www.mn-linux.org/ 
Never laugh at live dragons  |Dmitry's free,Jon's next? http://faircopyright.org

_______________________________________________
TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
http://www.mn-linux.org tclug-list at mn-linux.org
https://mailman.real-time.com/mailman/listinfo/tclug-list