topic ssh experts only in Operating System - HP-UX

ssh experts only

Mark Zurl — Fri, 01 Feb 2008 00:37:48 GMT

Is it possible for any entry in the $HOME/.ssh/known_hosts file to expire?

I have a cronjob that fails, and seems to indicate the imbedded "scp" in the script is failing because the "first time only" verification prompt (see below) keeps re-occuring.

OS is HP-UX 11.11, and 11.23

"The authenticity of host 'hpsystem (XXX.XX.31.101)' can't be established.
RSA key fingerprint is e3:5a:11:a4:60:a5:26:fb:11:41:e2:e0:93:15:25:c9.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'hpsystem' (RSA) to the list of known hosts."

OS is HP-UX 11.11 and 11.23.

Cheers,
Mark

Re: ssh experts only

Olivier Masse — Fri, 01 Feb 2008 00:44:54 GMT

Is the system you're connecting to part of a cluster? If this is the case, if the host keys of the nodes are not the same, any automated ssh or scp will prompt this message.

You can bypass it by using "-o StrictHostKeyChecking=no", but this might be against your security policy. If this is an issue, there are other solutions to this, such as using an ssh deamon listetning to a different port, but bound to the same host key on all your nodes.

Re: ssh experts only

Mark Zurl — Fri, 01 Feb 2008 00:53:29 GMT

Olivier, your awesome!

Yes, the problem does appear in a SG environment. Good call. I'll assume you are right and proceed with your suggestions.

If anyone else would like to comment, I'd like to hear your thoughts also.

Thanks again,
Mark

Re: ssh experts only

Michael Steele_2 — Fri, 01 Feb 2008 01:05:57 GMT

Set the cronjob to include debugging ' ssh -v -v -v ' and 'cksum' the key files on all nodes. Regenerate new keys?

Re: ssh experts only

Mark Zurl — Fri, 01 Feb 2008 01:19:25 GMT

Michael -
Thanks for your input.
Mark

Re: ssh experts only

Mark Zurl — Mon, 04 Feb 2008 21:06:10 GMT

I have modified the client configuration as suggested in the thread.