Hacker News Reader

Comment by cmrx64 | Hacker News Reader

> StrictHostKeyChecking=no

And welcome to MITM haven. This is awful advice if you care about the first S in SSH.

Depends on your circumstances, really. If you're in an environment with lots of VM's floating around, being created, destroyed, and so on, dealing with SSH's paranoia (why can't I just dismiss a warning about a host/key mismatch instead of having to edit .known_hosts?) quickly becomes an exercise in frustration for dubious security benefit. (If the enemy is on your LAN and able to manipulate your DNS, you've already lost)

On your home box, sure. But let's not pretend there's not a reason for the option to exist.

In which case, just use telnet. Seriously.

I use an alias to select when to, and not to, use host keys;

alias ssht='ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'

ssht floaty.vm # does not use host key checking

ssh my.bastion.host # validates host key

Really I ought to get SSHFP records populated when my vm's are created...

In these environments you can use server certificates

https://www.digitalocean.com/community/tutorials/how-to-crea...

What would be good is an interactive confirmation when a host fingerprint has changed, instead of a flatout abortion and having to edit your `known_host` file. I have to SSH into hundreds/thousands of VM that reuse the same IPs/FQDN sometimes, and the strict host checking is a major PITA. I haven't turned it off tho, I prefer the pain to MITM.

I wonder if SSHFP records on Avahi/mDNS would work?

Don't use SSH in a trust-on-first-use configuration in that situation.

There are two other modes to use. Either DNSSEC with SSHFP fingerprints, or sign your host keys with a CA key that you install on all your machines.

A decent configuration management tool could also keep known_hosts up to date, but it tends not to be worth the trouble. Do the above first.

Reply on news.ycombinator.com