generating known host entry

Question

I would like to create a known_host entry but for some security ( permission ) reasons cannot add it directly when prompted for adding.

Are you sure you want to continue connecting (yes/no) --> cannot say Yes

Wondering if there is a way to generate the entry ( print on command line ), so I can put it manually in the known_hosts file. I have the RSA key fingerprint.

TO paraphrase the question can I specify my own known_host entry file to generate the above entry ?

Just fyi:- I also have access to ssh-keygen command, ssh-keyscan and others are not available. Please comment if above information is insufficient and I can answer

Answer 1

You can use the -o switch to your ssh command to manually specify an alternative hosts file:

$ ssh -o UserKnownHostsFile=~/known_hosts.txt myserver

That will put the content into known_hosts.txt in your home directory, or you can change it to anywhere you should have write permissions to.

Answer 2

If you use this:

ssh -o StrictHostKeyChecking=no server.example.net

you may be able to avoid the question altogether, but BEWARE, by doing this you are avoiding an important check that SSH uses to verify the identity of the remote host. You've mentioned that you have the RSA fingerprint. Check it, when using this option.

You asked how you might "generate" the entry that you'd add to your known_hosts file. I'll assume you're using OpenSSH.

On each of the servers you're connecting to, you'll need to find out where the remote host's SSH keys live. In Linux and FreeBSD, everything should be in /etc/ssh/. In OSX, the SSH configuration including keys are all right in /etc/. If you're not sure, you may be able to find the keys with:

find /etc/ -name ssh_host\*.pub -print

Most likely, you'll have results like this:

/etc/ssh/ssh_host_dsa_key.pub
/etc/ssh/ssh_host_rsa_key.pub

The content of these files on the remote servers can be added verbatim to the known_hosts file used by your ssh client. And obviously, if you normally use only one type of key, you probably don't need the contents of both files.

The other question you asked was whether it was possible to specify an alternate known_hosts file. The other answer to this question gives you instructions for that.

Note that you can also specify an alternate known_hosts file using an entry in your ~/.ssh/config file. For example:

host cloudhost*
    UserKnownHostsFile ~/.ssh/known_hosts_cloud

This might work for you if you collect all your host keys into the named file, and have hostnames like cloudhost1, cloudhost2, ... .