Yes, the underlying problem is NAT. I suppose the real solution is to wait for IPv6 to hit the streets here.

If you have to do this (behind NAT?) I’d suggest using a local SSH config instead (~/.ssh/config) and only disable the checks for known for known hosts.

@BikerBreath

That’s not really a good idea. If one set of keys was compromised then every machine would be affected.

It’s *good* that SSH asks you by default if you’re connecting to a new host. This allow you to establish the trust in the initial connection – once you do that you can ensure all subsequent connections to that host is 100% that host and 100% encrypted with no snooping. If the fingerprints don’t match from your known one SSH will warn you possibly preventing you from being victim of a MITM attack.

Copy one set of host ssh key files to all ssh servers behind the same ip address. These keys are in several files named similarly to
/etc/ssh/ssh_host_dsa_key

Some of those key files (the private keys) are only root-readable. Keep them that way.

With the same host keys on all ssh servers, there will be no complaint about “host key has changed” from your ssh client, and you can keep strict host key checking enabled.

Of course, I have no idea about cryptography, so I wouldn’t know if the act of sharing your host keys across many disparate servers is a good idea. So far, so good, though.

Can someone comment on security issues, or other issues that could result from sharing of these host keys?

– Kevin

make
/bin/sh /root/sources/ssh2-0.10/libtool –mode=compile cc -I. -I/root/sources/ssh2-0.10 -DPHP_ATOM_INC -I/root/sources/ssh2-0.10/include -I/root/sources/ssh2-0.10/main -I/root/sources/ssh2-0.10 -I/usr/include/php -I/usr/include/php/main -I/usr/include/php/TSRM -I/usr/include/php/Zend -I/usr/include/php/ext -I/usr/include/php/ext/date/lib -I/usr/local/include -DHAVE_CONFIG_H -g -O2 -c /root/sources/ssh2-0.10/ssh2.c -o ssh2.lo
mkdir .libs
cc -I. -I/root/sources/ssh2-0.10 -DPHP_ATOM_INC -I/root/sources/ssh2-0.10/include -I/root/sources/ssh2-0.10/main -I/root/sources/ssh2-0.10 -I/usr/include/php -I/usr/include/php/main -I/usr/include/php/TSRM -I/usr/include/php/Zend -I/usr/include/php/ext -I/usr/include/php/ext/date/lib -I/usr/local/include -DHAVE_CONFIG_H -g -O2 -c /root/sources/ssh2-0.10/ssh2.c -fPIC -DPIC -o .libs/ssh2.o
/root/sources/ssh2-0.10/ssh2.c:49: error: duplicate ‘static’
/root/sources/ssh2-0.10/ssh2.c: In function ‘zif_ssh2_methods_negotiated’:
/root/sources/ssh2-0.10/ssh2.c:483: warning: assignment discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c:484: warning: assignment discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c:485: warning: assignment discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c:486: warning: assignment discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c:487: warning: assignment discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c:488: warning: assignment discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c:489: warning: assignment discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c:490: warning: assignment discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c:491: warning: assignment discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c:492: warning: assignment discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c: In function ‘zif_ssh2_fingerprint’:
/root/sources/ssh2-0.10/ssh2.c:536: warning: assignment discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c: In function ‘zif_ssh2_poll’:
/root/sources/ssh2-0.10/ssh2.c:885: error: ‘zval’ has no member named ‘is_ref’
/root/sources/ssh2-0.10/ssh2.c:885: error: ‘zval’ has no member named ‘refcount’
/root/sources/ssh2-0.10/ssh2.c:895: error: ‘zval’ has no member named ‘is_ref’
/root/sources/ssh2-0.10/ssh2.c:896: error: ‘zval’ has no member named ‘refcount’
/root/sources/ssh2-0.10/ssh2.c: In function ‘zif_ssh2_publickey_add’:
/root/sources/ssh2-0.10/ssh2.c:1005: error: ‘zval’ has no member named ‘is_ref’
/root/sources/ssh2-0.10/ssh2.c:1006: error: ‘zval’ has no member named ‘refcount’
/root/sources/ssh2-0.10/ssh2.c:1038: warning: passing argument 1 of ‘_efree’ discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c: In function ‘zif_ssh2_publickey_list’:
/root/sources/ssh2-0.10/ssh2.c:1097: warning: passing argument 4 of ‘add_assoc_stringl_ex’ discards qualifiers from pointer target type
/root/sources/ssh2-0.10/ssh2.c:1098: warning: passing argument 4 of ‘add_assoc_stringl_ex’ discards qualifiers from pointer target type
make: *** [ssh2.lo] Error 1

Error menssage:

——————————————-

[Thu Nov 04 15:03:43 2010] [error] [client 9.18.218.31] PHP Warning: ssh2_connect() [function.ssh2-connect]: Unable to connect to 9.18.218.20 on port 22 in /var/www/html/teste_ssh01.php on line 11

[Thu Nov 04 15:03:43 2010] [error] [client 9.18.218.31] PHP Warning: ssh2_connect() [function.ssh2-connect]: Unable to connect to 9.18.218.20 in /var/www/html/teste_ssh01.php on line 11

——————————————-

Script:

<?php

//Tecmaster
$server = '9.18.218.10';
$user = 'root';
$pass = 'pass';

if (!function_exists("ssh2_connect")) die("function ssh2_connect doesn't exist");

if(!($con = ssh2_connect($server, 22))){
echo "fail: unable to establish connection\n";
}
else {

if(!ssh2_auth_password($con, $user, $pass)) {
echo "fail: unable to authenticate\n";
} else {
// allright, we're in!
echo "okay: logged in…\n";

// execute a command
if (!($stream = ssh2_exec($con, "df -h" ))) {
echo "fail: unable to execute command\n";
} else {
// collect returning data from command
stream_set_blocking($stream, true);
$data = "";
while ($buf = fread($stream,4096)) {

$data .= $buf."”;
echo $buf.”";
}

fclose($stream);
}
}
}

?>