Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to connect to a host via SSH but I don't want the hostname to be added to my ~/.ssh/known_hosts.

How can I do that?

share|improve this question

If you want this behavior because you're working with cloud servers (AWS EC2, Rackspace CloudServers etc.) or you're constantly provisioning new images in Vagrant you may want to update your SSH config instead of adding bash aliases or more options on the command line.

Consider adding something like:

Host * 
  StrictHostKeyChecking no
  UserKnownHostsFile /dev/null
  User foo
  LogLevel QUIET
  • Use as strict as regex for host as possible to be secure.
  • Setting the LogLevel to QUIET will keep the Warning which Guillaume mentioned from showing up
share|improve this answer
You really should try to not fully disable StrictHostKeyChecking, so cclark's answer is a great compromise for working with cloud servers. – Alex Recarey Sep 24 '12 at 16:39
This proved very helpful to me as I was using Shipit (a JavaScript deployment tool) against Vagrant. I couldn't easily get at the parameters Shipit was passing to SSH so this allowed me to sidestep the tool and tell it what I did and didn't want it to remember. – John Munsch Mar 11 '15 at 3:06
LogLevel is what I was looking for. It has the added advantage of not showing the company configured notice when running scripts! (I am running now w/ loglevel ERROR) – Anshu Prateek Aug 4 '15 at 3:46
up vote 34 down vote accepted
-o "UserKnownHostsFile /dev/null"

should work.

share|improve this answer
Works as intended, but it will always report: "Warning: Permanently added 'hostname,ip' (RSA) to the list of known hosts." I made that go away with: 2>&1 | grep -v "^Warning: Permanently added" – Guillaume Boudreau May 18 '11 at 17:34
This is what I needed for my scenario - no DNS, LAN with DHCP, computers getting different addresses all the time. I will need to type 'yes' all the time, but otherwise it's great. – Tomasz Gandor Oct 3 '14 at 4:47

I feel like adding the host key to your known_hosts (the folks running these services are, in my experience, at least smart enough to keep their host keys consistent between machines serving the same hostname) and then turning on StrictHostKeyChecking, turning off CheckHostIP, and logging with LogLevel ERROR will give you the best experience without sacrificing security. (Ok, without CheckHostIP you do need to trust DNS, which is a huge gaping hole without widespread DNSSEC or something similar; but we'll just sweep that under the rug for the moment.)

I use a read-only known_hosts file, so I have to do something or I get endless warnings about not being able to add entries to known_hosts.

What I use:

Host *
StrictHostKeyChecking yes
CheckHostIP no
LogLevel ERROR

I would like these services to publish their SSH host keys on their websites via HTTPS, so I can copy them explicitly without having to connect first and potentially expose myself to a MITM attack.

share|improve this answer

I suggest

LogLevel ERROR


LogLevel QUIET

so you still get "Could not resolve hostname" and other such errors

share|improve this answer
you should be able to trust your SSH connections, imho. Not just make it silent about your risks. – sylvainulg Jan 23 '15 at 9:16

Have you tried disabling StrictHostKeyChecking? You can do it with the -o option or in the configuration file ~/.ssh/config.

share|improve this answer
I'm already using that. But it has a different effect: It loweres the strictness for the host key checking. I.e. when the host is unknown, it still connects when you disable that option. Thus, it still saves the host. But I think I have found the right solution (see my answer). – Albert May 15 '10 at 0:29

I found the following .ssh/config entries useful (LAN with DHCP and DNS):

 CheckHostIP no

 Host *.*
 CheckHostIP yes

Result is local machine names "zora" or "goron" will not check against dynamically assigned IP addresses, but or will still have their static IPs confirmed.

share|improve this answer

For a single ssh session, use this

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null user@host
share|improve this answer
This adds nothing new to an accepted answer on a question that is 5 years old. – JakeGould Dec 16 '15 at 6:58

protected by JakeGould Dec 16 '15 at 6:58

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.