ssh Tunnels

raptor · Apprentice Joined: 20 Sep 2002 Posts: 171

hi,

When I try to build a tunnel (from a script) I'm getting something like this :

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
xx:xx:Xx:xx:xx:Xx...
Please contact your system administrator.
Add correct host key in /..../.ssh/known_hosts to get rid of this message.
Offending key in /....../.ssh/known_hosts:13
RSA host key for localhost has changed and you have requested strict checking.
Host key verification failed.

I use "ssh ... -o NoHostAuthenticationForLocalhost=no ....", but even with this once I make the connection...
the ssh adds localhost-line into known_hosts and the next time I try to make the tunnel I have to go and
manualy delete this line...

So my question is ? Is there a way to tell to ssh not to add lines into known_hosts file ?

hede · Posted: Fri Jan 26, 2007 6:54 am Post subject:

Its "NoHostAuthenticationForLocalhost=yes" or maybe "HostAuthenticationForLocalhost=no" (don't know if it works)

no+no means "yes, do HostAuthenticationForLocalhost" ;-)

(double negation)
_________________
Der süsse Pinguin ist mir lieber als die kleinen weichen, die einem nur kaputte Fenster verkaufen

think4urs11 · Posted: Fri Jan 26, 2007 8:28 am Post subject:

StrictHostKeyChecking no
_________________
Nothing is secure / Security is always a trade-off with usability / Do not assume anything / Trust no-one, nothing / Paranoia is your friend / Think for yourself

raptor · Apprentice Joined: 20 Sep 2002 Posts: 171

So finally the correct one is :
-o NoHostAuthenticationForLocalhost=yes -o StrictHostKeyChecking=no

first one to not bother for localhost and second one to not bother for known_hosts.(i.e doesn't matter even if it writes to this file)
I tried before NoHostAuthenticationForLocalhost, StrictHostKeyChecking and CheckHostIP, but probabaly in wrong combination ;|

thanx again