Home / server / Questions / 853504
Accepted
Sammitch
Asked: 2017-06-02 12:38:23 +0800 CST

Explicit test for SSH host key change

  • 772

I'm writing some automations and I've run into a problem where a host's key has changed and a wrench gets thrown into the works. I'd like to add a pre-flight check for this specific condition, but I can't seem to get ssh to return anything more than its catch-all 255 return code.

eg:

$ ssh -o StrictHostKeyChecking=yes foobar@squiffy-host ls; echo $?
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
...snip...
255

How can I detect this one, specific case?

linux

2 Answers

  1. Building a little bit on your shell snippit, you could try this:

    $ ssh -o StrictHostKeyChecking=yes foobar@squiffy-host ls 2>&1 |grep "WARNING: POSSIBLE DNS SPOOFING DETECTED" >/dev/null; echo $?
0

    It should output 0 if the grep invocation finds the error message, and 1 if not.

    • 0
  2. Best Answer

    At this point I'm not terribly optimistic that there's a perfect answer, so I've gone with your suggestions to parse the error text.

    ## Return codes:
#   0: No problem
#   1: Host key problem
#   2: Unhandled error
function testhostkey() {
    user=$1
    hostname=$2
    res=$( ( ssh -o StrictHostKeyChecking=yes ${user}@${hostname} exit 1>/dev/null ) 2>&1 )
    code=$?

    if [ $code -eq 0 ]; then
        return 0
    elif [ $code -eq 255 ]; then
        while read line; do
            case "$line" in
                'WARNING: POSSIBLE DNS SPOOFING DETECTED!')
                    continue
                    ;;
                'WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!')
                    continue
                    ;;
                *)
                    echo "Unhandled SSH error message: $line" >&2
                    echo "$res" >&2
                    return 2
                    ;;
            esac
        done < <(echo "$res" | grep '^@\s\+' | sed 's/@\s\+\(.*\)\s\+@/\1/' | sed -e 's/^\s\+//' -e 's/\s\+$//')
        return 1
    else
        printf "Unhandled return code from SSH: %d\n%s\n" $code "$res" >&2
        return 2
    fi
}

    Basically, IF the return code is 255 AND all error messages are within the specified set THEN the return code is 1.

    All other error messages/codes return 2, and no errors returns 0.

    • 0