Linux Networking Cookbook

3.13. Getting Multiple SSH Host Keys Past NAT

Problem

You tried the second method in the previous recipe and it worked like a charm. Until you tried to SSH into a second LAN host, that is. Because the remote SSH client sees only a single IP address for your entire network, it freaks out when you try to log in to a second host, displays this scary warning, and refuses to let you log in:

	@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
	WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
	@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
	IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

Every LAN host is going to have a different host key with the same IP address because all outgoing traffic is source NAT-ed to the firewall address, so SSH is going to think you're trying to log in to a single PC that keeps changing the host key. What are you going to do? Deleting the host key every single time doesn't seem very practical, and you don't want to turn off StrictHostKeyChecking.

Solution

Use OpenSSH's elegant mechanism for managing multiple host keys that are bound to the same IP address.

Create a ~/.ssh.config file on your remote PC. This example manages the host keys for host1 and host2. The Host entry can be anything you like; some sort of descriptive name is good. HostName is either the fully qualified domain name or IP address of the firewall. Port is the port number from the corresponding iptables rule, and UserKnownHostsFile is the name of file that you want to store the host ...