Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to connect to a host via SSH but I don't want the hostname to be added to my ~/.ssh/known_hosts.

How can I do that?

share|improve this question
add comment

5 Answers

I feel like adding the host key to your known_hosts (the folks running these services are, in my experience, at least smart enough to keep their host keys consistent between machines serving the same hostname) and then turning on StrictHostKeyChecking with LogLevel ERROR will give you the best experience without sacrificing security.

I use a read-only known_hosts file, so I have to do something or I get endless warnings about not being able to add entries to known_hosts.

What I use:

Host github.com *.github.com
StrictHostKeyChecking yes
LogLevel ERROR

Here's what I'd like:

(1) These services should publish their SSH host keys on their websites via HTTPS, so I can copy them explicitly without having to connect first and potentially expose myself to a MITM attack.

(2) OpenSSH should provide a facility to disable adding host keys by IP.

share|improve this answer
add comment

I suggest

LogLevel ERROR

over

LogLevel QUIET

so you still get "Could not resolve hostname" and other such errors

share|improve this answer
add comment

If you want this behavior because you're working with cloud servers (AWS EC2, Rackspace CloudServers etc.) or you're constantly provisioning new images in Vagrant you may want to update your SSH config instead of adding bash aliases or more options on the command line.

Consider adding something like:

Host *.mydomain.com 
  StrictHostKeyChecking no
  UserKnownHostsFile /dev/null
  User foo
  LogLevel QUIET
  • Use as strict as regex for host as possible to be secure.
  • Setting the LogLevel to QUIET will keep the Warning which Guillaume mentioned from showing up
share|improve this answer
    
You really should try to not fully disable StrictHostKeyChecking, so cclark's answer is a great compromise for working with cloud servers. –  Alex Recarey Sep 24 '12 at 16:39
add comment
up vote 16 down vote accepted
-o "UserKnownHostsFile /dev/null"

should work.

share|improve this answer
1  
Works as intended, but it will always report: "Warning: Permanently added 'hostname,ip' (RSA) to the list of known hosts." I made that go away with: 2>&1 | grep -v "^Warning: Permanently added" –  Guillaume Boudreau May 18 '11 at 17:34
add comment

Have you tried disabling StrictHostKeyChecking? You can do it with the -o option or in the configuration file ~/.ssh/config.

share|improve this answer
    
I'm already using that. But it has a different effect: It loweres the strictness for the host key checking. I.e. when the host is unknown, it still connects when you disable that option. Thus, it still saves the host. But I think I have found the right solution (see my answer). –  Albert May 15 '10 at 0:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.