SSH UserKnownHostsFile 检查

Summary: Author: 张亚飞 | 阅读时间: 1 minute read | Published: 2020-01-08
Filed under Categories: SSHTags: Linux, SSH,

禁用 ssh 公钥检查

禁用 SSH 远程主机的公钥检查

  • 首先看看什么是 SSH 公钥检查
The authenticity of host '192.168.0.110 (192.168.0.110)' can't be established.
RSA key fingerprint is a3:ca:ad:95:a1:45:d2:57:3a:e9:e7:75:a8:4c:1f:9f.
Are you sure you want to continue connecting (yes/no)?
  • 如果因为某种原因(服务器系统重装,服务器间IP地址交换,DHCP,虚拟机重建,中间人劫持),该IP地址的公钥改变了,当使用 SSH 连接的时候,会报错:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
e9:0c:36:89:7f:3c:07:71:09:5a:9f:28:8c:44:e9:05.
Please contact your system administrator.
Add correct host key in /home/jiangxin/.ssh/known_hosts to get rid of this message.
Offending key in /home/jiangxin/.ssh/known_hosts:81
RSA host key for 192.168.0.110 has changed and you have requested strict checking.
Host key verification failed.
  • 如何防止远程主机公钥改变导致 SSH 连接失败

在首次连接服务器时,会弹出公钥确认的提示.这会导致某些自动化任务,由于初次连接服务器而导致自动化任务中断.或者由于 ~/.ssh/known_hosts 文件内容清空,导致自动化任务中断. SSH 客户端的 StrictHostKeyChecking 配置指令,可以实现当第一次连接服务器时,自动接受新的公钥.只需要修改 /etc/ssh/ssh_config 文件,包含下列语句:

Host *
 StrictHostKeyChecking no

或者在 ssh 命令行中用 -o 参数

$ ssh -o StrictHostKeyChecking=no 192.168.0.110
  • 如何防止远程主机公钥改变导致 SSH 连接失败
ssh -o UserKnownHostsFile=/dev/null 192.168.0.110

看,提示信息由公钥改变中断警告,变成了首次连接的提示. 和之前提到的 StrictHostKeyChecking 配置配合使用,则不再有任何警告出现了:

$ ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null 192.168.0.110
Warning: Permanently added '192.168.0.110' (RSA) to the list of known hosts.
coam@192.168.0.110's password:

如果设置了无口令 SSH 登录(即通过客户端公钥认证),就可以直接连接到远程主机.这是基于 SSH 协议的自动化任务常用的手段.


Comments

  • MatThet says: 2020-04-25 00:41:47

    Cialis Sotto La Lingua https://buyciallisonline.com/# - Cialis Buy Cheap Amoxil <a href=https://buyciallisonline.com/#>Buy Cialis</a> Battling Anxiety Nhs

Cor-Ethan, the beverage → www.iirii.com