Trust SSH server based on key instead of if key+IP match

Is it possible to make the ssh client not care what IP a ssh server is behind (and if a different server was behind that IP earlier) but instead trust specific server keys? (And maybe nickname those keys?) I use dynamic DNS and I have IPv6 privacy extensions enabled on some computers and am always getting asked if it think it's safe to connect. Another possibility is addresses assigned by DHCP getting assigned to different ssh servers and causing all sorts of 'key doesn't match IP' errors.


Add a nickname for your server in ~/.ssh/config, and turn off CheckHostIP for this server.

Host nickname
HostName example.dyndns.org
CheckHostIP no

Before you connect to the server for the first time, you can copy the public key out-of-band: grab /etc/ssh/ssh_host_rsa_key.pub from the server, remove the root@hostname part at the end of the line, add example.dyndns.org at the beginning, and append the line to ~/.ssh/known_hosts. Optionally run ssh-keygen -H to hash the host name (this is only useful if you're concerned about the privacy of that entry if someone steals your hard disk or your backups, which for 99.99% of people is useless because the information is present in some other nearby location anyway).


In /etc/ssh/ssh_config add the line

CheckHostIP no

However, this takes away a bit of the Secure in SSH, because any machine can hide behind the IP or DynDNS name you connect to.