On Sun, Oct 04, 2020 at 10:50:32PM +1100, Damien Miller wrote:
> On Sun, 4 Oct 2020, Matthieu Herrb wrote:
>
> > On Sun, Oct 04, 2020 at 09:24:12PM +1100, Damien Miller wrote:
> > > On Sun, 4 Oct 2020, Damien Miller wrote:
> > >
> > > > No - I think you've stumbled on a corner case I hadn't anticipated.
> > > > Does your configuration override CheckHostIP at all?
> >
> > No.
> >
> > > >
> > > > What are the known_hosts entries for the hostname and IP?
> > >
> > > Also, do you use HashKnownHosts? or do you have any hashed host lines
> > > in known_hosts?
> >
> > Yes I use HashKnownHosts yes
>
> Thanks - I think that was the missing piece of the puzzle. Can you
> please try this diff? It lets UpdateKnownHosts store entries for
> the IP address as well as the hostname.
>
> diff --git a/hostfile.c b/hostfile.c
> index 3dc9809..9ec9afa 100644
> --- a/hostfile.c
> +++ b/hostfile.c
> @@ -449,6 +449,9 @@ write_host_entry(FILE *f, const char *host, const char *ip,
> else
> error("%s: sshkey_write failed: %s", __func__, ssh_err(r));
> fputc('\n', f);
> + /* If hashing is enabled, the IP address needs to go on its own line */
> + if (success && store_hash && ip != NULL)
> + success = write_host_entry(f, ip, NULL, key, 1);
> return success;
> }
>
thanks for the patch, unfortunatly it doesn't solve the issue. ssh is
still claiming that the ecdsa key present in known_hosts differs from
the ed25519 key.
And if I answer yes to the question known_hosts is not updated.
The way to fix this is still to remove the ecdsa key from
known_hosts manually.
--
Matthieu Herrb
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
