openssh unix dev - Sep 2002 - host_key and fingerprint problem with protocol 2

Hi all,

I just want to upgrade from protocol 1.5 to 1.99 and 2.0, respectively and run
into the following problems:

The situation is the following:

I have a client ("c") inside the firewall and two servers outside
("a" and "b"). The firewall accepts connections on two ports
(22136 and 22137) and directs the connections directly to port 22 of the two
servers "a" und "b". The command I have to type in is

ssh -p 22136 root at firewall

as well as

ssh -p 22137 root at firewall

and the first one connects me to the server "a" where the second one
connects me to servber "b". The two servers have identical host-keys
fpr rsa1, rsa und dsa cases. With protocal 1.5 the client learned the host_key
and everything worked fine that means I can connect with "a" and
"b" and the client doesn't tell me something from "man in the
middle..."

With the lines

ssh -2 -p 22136 root at firewall

as well as

ssh -2 -p 22137 root at firewall

the client doesn't recognise that the host_keys are identical and says
everytime that there can be a "man in the middle..."

Does have anybody a solution?

Regards
Stephan



--
LDS Brandenburg
Dr. Stephan Hendl
fon: +49-(0)331-39 471
fax: +49-(0)331-27548 1187
EMail: stephan.hendl at lds.brandenburg.de

HostKeyAlias
             Specifies an alias that should be used instead of the real host
             name when looking up or saving the host key in the host key
             database files.  This option is useful for tunneling ssh connec-
             tions or for multiple servers running on a single host.

Stephan Hendl wrote:
[snip]
> the client doesn't recognise that the host_keys are identical and
> says everytime that there can be a "man in the middle..."
This is probably because ssh on "c" knows a v2 host key for your
firewall which is different from "a" and "b".
> Does have anybody a solution?
In $HOME/.ssh/config on "c":

Host a
	Hostname firewall
	Port 22136
	HostKeyAlias a

Host b
	Hostname firewall
	Port 22137
	HostKeyAlias b

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.