3

As far as I know the default ssh option StrictHostKeyChecking is set to ask so the first ssh connection seems like:

$ ssh host.example.com
The authenticity of host 'host.example.com (1.2.3.4)' can't be established.
RSA key fingerprint is 52:9b:0a:f1:e4:51:1b:96:8c:b7:96:7c:d3:d2:7d:9f.
Are you sure you want to continue connecting (yes/no)?
  • I'd like to automatically add host key for the first time assuming the possible security issue.
  • I'd like the host key to be used by any local user automatically (e.g. without any extra ssh command-line options).

3 Answers 3

1

I think keyscan is cleaner :

/usr/bin/ssh-keyscan $host >> $SSH_KNOWN_HOSTS

If you need to remove a stale entry first :

/usr/bin/ssh-keygen -R $host -f $SSH_KNOWN_HOSTS

Then you don't need to suffer the warnings ever again.

0

I've read man ssh and man ssh_config and figured out the solution for this:

#!/bin/bash

SSH_KNOWN_HOSTS=/etc/ssh/ssh_known_hosts
[ -e $SSH_KNOWN_HOSTS ] || touch $SSH_KNOWN_HOSTS
for host in \
    host1.example.com \
    host2.example.com \
; do
    ssh-keygen -R $host -f $SSH_KNOWN_HOSTS
    ssh -q -o StrictHostKeyChecking=no -o BatchMode=yes -o UserKnownHostsFile=$SSH_KNOWN_HOSTS $host echo '' || true
done
chmod a+r $SSH_KNOWN_HOSTS

It works but seems hacky. Do you know a shorter way to do this ?

1
  • Remove the -o StrictHostKeyChecking=no because it disables the hostkey check. Feb 12 at 20:46
0

Add the pubkey to /etc/ssh/ssh_known_hosts and it will work for all users in a system. Please note that the file potentially may have other keys. Or you can specify an additional known hosts file:

ssh -o UserKnownHostsFile=/root/.ssh/example.com.known_hosts

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .