1. Introduction
As the golden standard of secure remote access, the in /etc/ssh/ssh_config.
When hashed, the first field of each line starts with |1|, a HASH_MAGIC marker. After the latter, the field continues with a random 160-bit string, otherwise known as a salt, followed by a 160-bit .
The main idea is to hide the IP address or hostname data, which would otherwise be directly visible
Either way, known_hosts contains a mapping between a server as identified by its characteristics and its key.
## Known Hosts Checking
When connecting to a remote host, SSH checks the known_hosts file of the client to confirm the address or hostname for the server match the key we get from it.
If there is a match, the session setup can continue. Otherwise, we get an error.
The entry for 192.168.6.66 in the known_hosts file doesn’t match the (Elliptic Curve Digital Signature Algorithm, ECDSA) key we got back from the server at that address.
Critically, if we don’t know what caused the error, we should heed the text in capital letters: something nasty can indeed be happening.
On the other hand, the reasons for such an issue can be valid and trivial:
In fact, there can be many more.
## Bypass Known Hosts
The error text when connecting to a misidentified host tells us a few remedies for the situation.
### Correct the Row
Since we already know which row of the known_hosts file doesn’t match (the suffix :1 of /home/erickquinteros/.ssh/known_hosts:1), we can correct the host data, key type, and value. By default, there are several host keys:
/etc/ssh/ssh_host_ed25519_key
### Remove the Row
If we trust the host and don’t want to bother correcting the line by hand, we can simply remove the entry with the supplied command:
ssh-keygen -f "/home/user_name/.ssh/known_hosts" -R "github.com"
# Host github.com found: line 1
# Host github.com found: line 2
# Host github.com found: line 3
/home/user_name/.ssh/known_hosts updated.
Original contents retained as /home/user_name/.ssh/known_hosts.old
Permanently Ignore statement for the offending server in our ssh_config:
We can disable several checks:
StrictHostKeyChecking no means we won’t need a match to connect to a server
UserKnownHostsFile /dev/null_ overrides our default known_hosts path with the empty /dev/null
GlobalKnownHostsFile /dev/null overrides the default global known hosts file path again with the empty /dev/null
Essentially, this combination of three options strips the security of hosts checking and prevents additions to the known_hosts files for a given machine.
### Temporarily Ignore
We may want to ignore the known hosts only temporarily:
CODE $ ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o GlobalKnownHostsFile=/dev/null 192.168.6.66
StrictHostKeyChecking no means we won’t need a match to connect to a server
UserKnownHostsFile /dev/null_ overrides our default known_hosts path with the empty /dev/null
GlobalKnownHostsFile /dev/null overrides the default global known hosts file path again with the empty /dev/null
Essentially, this combination of three options strips the security of hosts checking and prevents additions to the known_hosts files for a given machine.
### Temporarily Ignore
We may want to ignore the known hosts only temporarily:
$ ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o GlobalKnownHostsFile=/dev/null 192.168.6.66
Directly pass each of the options via -o flags when connecting to the misidentified server. Doing so enables easier debugging without global changes to the configuration.
Bibliography
ssh-keygen:
SOCIAL SHARE CARD GENERATOR