SSH, ServiceGuard, and known_hosts file

[Mark Zurl]

I have a ServiceGuard MetroCluster (HP-UX 11.23 on Itanium)and I'm having a problem with SSH and package migration.

The problem is this; a userid establishes contact with a SG package, e.g., "$ssh pkgname", and creates an entry in the known_hosts file. Later, the package migrates to another node, and SSH then mistakenly thinks I have a man-in-the-middle hack. In the interest of being brief, I will assume you, the reader, understands why.

One way to resolve this is to ensure all cluster nodes have the same digital ID or fingerprint. However, this would force me to have all my users re-create their known_hosts file, and so I would much prefer to use host name aliasing within the known_hosts file instead.

My systems use HP's SSH version 4.40.007, and the format of known_hosts is unlike other versions in that the host and IP does not appear at the beginning of the known_host file record. All the documentation I have (O'Reilly, etc), show a different format for known_hosts.

Has anyone on this forum ever implemented known_hosts aliasing with SSH by modifying the known_hosts file? Any feedback would be appreciated.

[Rita C Workman]

Not sure if this is the answer, but here's a thought........

Have you considered putting the "/home" or whatever directory you have set up as your users home directory, into the package? That way the userid accounts follow the package, hence so does their associated .ssh files.

Like I said, just a thought,
Rgrds,
Rita

[Doug O'Leary · Accepted solution]

Hey;

There's actually a pretty slick way to work around this. You don't want to use the same host key for all the nodes - that weakens the security that we're using ssh for in the first place.

The trick is to use hostkeyaliases in the ~/.ssh/config file and the known_hosts file.

First, configure ~/.ssh/config:

host mjp
hostname sapmjpdb.myco.com
user oracle
HostKeyAlias MJP

In the known hosts, the format for the file is:

${host},${ip},${aliase} ${rest-o-key}

So, you can have:

node1,192.168.12.10,MJP ssh-rsa AAA [[snip]]
node2,192.168.12.12,MJP ssh-rsa AAA [[snip]]

once all that's in place, you can:

ssh mjp ls -ld /tmp

and have it work regardless on which node sapmjpdb is running.

I used to have a lessons learned entry on this but it got hosed when my firewall died. I'll have to regenerate it as it's pretty nice way to have your cake and eat it too.

HTH;

Doug O'Leary

[Doug O'Leary]

...

And, having read the rest of your post now ( :( )...

it sounds like you have your known hosts file hashed.

Make sure "HashKnownHosts no" is set in /opt/ssh/etc/ssh_config. Unfortunately, you'll have to blast the file and regenerate it.

Doug O'leary

[Mark Zurl]

I think Doug's solution was what I was looking for.

Thanks for everyone assistance!

Mark Z

[Mark Zurl]

I have now successfully resolved this problem, both with Doug's assistance and also from HP's technical phone support.

The first step was resolving the HASH of the known_hosts file. I believe Doug suggested turning off the HASH in the clients config file, but in the end, I used this command to generate the un-hashed record in known_hosts:

$ ssh -o "HashKnownHosts no"

Then its a simple matter of editing the known_hosts file to add the package alias. Once that was done, everything fell in place.

There is a good discussion of this problem in O'Reilly's SSH Definitive Guide, see Chapter Three, page 82, which also has syntax examples of how to add the package alias.

If after editing the known_hosts file, you would prefer to re-HASH it, I believe you can use this command (below):

ssh-keygen -H

Thanks for everyones help!

[Mark Zurl]

Problem resolved, closing thread.