ssh experts only

[Mark Zurl]

Is it possible for any entry in the $HOME/.ssh/known_hosts file to expire?

I have a cronjob that fails, and seems to indicate the imbedded "scp" in the script is failing because the "first time only" verification prompt (see below) keeps re-occuring.

OS is HP-UX 11.11, and 11.23

"The authenticity of host 'hpsystem (XXX.XX.31.101)' can't be established.
RSA key fingerprint is e3:5a:11:a4:60:a5:26:fb:11:41:e2:e0:93:15:25:c9.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'hpsystem' (RSA) to the list of known hosts."

OS is HP-UX 11.11 and 11.23.

Cheers,
Mark

[Olivier Masse · Accepted solution]

Is the system you're connecting to part of a cluster? If this is the case, if the host keys of the nodes are not the same, any automated ssh or scp will prompt this message.

You can bypass it by using "-o StrictHostKeyChecking=no", but this might be against your security policy. If this is an issue, there are other solutions to this, such as using an ssh deamon listetning to a different port, but bound to the same host key on all your nodes.

[Mark Zurl]

Olivier, your awesome!

Yes, the problem does appear in a SG environment. Good call. I'll assume you are right and proceed with your suggestions.

If anyone else would like to comment, I'd like to hear your thoughts also.

Thanks again,
Mark

[Michael Steele_2]

Set the cronjob to include debugging ' ssh -v -v -v ' and 'cksum' the key files on all nodes. Regenerate new keys?

[Mark Zurl]

Michael -
Thanks for your input.
Mark

[Mark Zurl]

I have modified the client configuration as suggested in the thread.