I need to be able to turn off host checking entirely
John Summerfield
summer at os2.ami.com.au
Thu Apr 11 08:23:23 EST 2002
I have a small LAN. The entire system is within my view - all the
hosts, the switch and the wire. If someone is in a a position to do a
"man in the middle" attack, there's no need - they already have me.
Over the other side of the room, and beside my desk, I have test
systems. I use disk caddies (see www.vipower.com for examples) and can
switch operating systems in about the time it takes to cycle power; I
pull one drive out (with power off), push in another and reboot.
One of the things the test system's used for is kickstart installing
Red Hat Linux, and a test can take less than 20 minutes.
Then there's my "production" system for the same box, and Windows
NT.....
Actually, NT's not involved in the problem.
I'm getting thoroughly sick of the checking the ssh command does, and
I've turned off as much as I can figure out, but I still get this:
[summer at numbat summer]$ ssh possum
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle
attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
22:dc:6b:57:31:b3:0a:3c:07:7e:8d:60:1a:c0:b7:5f.
Please contact your system administrator.
Add correct host key in /home/summer/.ssh/known_hosts to get rid of
this message.
Offending key in /home/summer/.ssh/known_hosts:2
Password authentication is disabled to avoid man-in-the-middle attacks.
X11 forwarding is disabled to avoid man-in-the-middle attacks.
Last login: Thu Apr 11 06:06:30 2002 from numbat.os2.ami.com.au
[summer at possum summer]$
Now, I suppose I can live with the messages (but I'd rather not). What
I really need to have the connexion to the machine to 'just work.'
I want X11 forwarding to work.
Just like this:
[summer at numbat summer]$ ssh dugite
Last login: Thu Apr 11 05:04:54 2002 from numbat.os2.ami.com.au
[summer at dugite summer]$
I appreciate there are several crude hacks I can use. Like supplying
the host key when I install on possum, but that seems to me even worse.
--
Cheers
John Summerfield
Microsoft's most solid OS: http://www.geocities.com/rcwoolley/
Note: mail delivered to me is deemed to be intended for me, for my
disposition.
==============================
If you don't like being told you're wrong,
be right!
More information about the openssh-unix-dev
mailing list