How do I skip the "known_host" question the first time I connect to a machine via SSH with public/private keys?
-
Why was this marked as the duplicate when it predates the other question?– Jason AxelsonApr 13, 2018 at 21:54
-
@JasonAxelson time isn't a consideration on SE. The question with the better set of answers will be kept open meta.stackexchange.com/a/159658/230282 meta.stackexchange.com/q/55251/230282 meta.stackexchange.com/q/240430/230282 meta.stackexchange.com/q/147643/230282– phuclvNov 21, 2023 at 17:18
8 Answers
All the other current answers are missing the UserKnownHostsFile=/dev/null
If you just want to do it once you can use:
ssh -o StrictHostKeychecking=no hostname
If you want to do it repeatedly you should add something like the following to your ~/.ssh/config
Host 192.168.0.*
StrictHostKeyChecking no
UserKnownHostsFile=/dev/null
To configure this on OpenSSH for Windows simply replace /dev/null
with NUL
.
Good explanation from: http://linuxcommando.blogspot.com/2008/10/how-to-disable-ssh-host-key-checking.html
-
2I've been hunting for away to filter out a subnet for months (not actively), this is exactly what I've been wanting. We have a small development network with dhcp and our devices are always getting new IP address, this making connecting to them MUCH easier. Thanks! Sep 1, 2015 at 15:24
Turn StrictHostKeyChecking
off via ssh_config
or command line options.
-
/etc/ssh/ssh_config or ~/.ssh/config --- or whatever the equivalent is on windows if that's your client platform Oct 14, 2009 at 15:58
This took me a while to find. The most common usecase I've seen is when you've got ssh tunnels to remote networks. All the solutions here produced warnings which broke my scripts (nagios).
The option I needed was:
NoHostAuthenticationForLocalhost yes
Which, as the name suggests also only applies to localhost.
You can get the public key, add it to known_hosts file and then rehash it:
ssh-keyscan -t rsa hostname >> .ssh/known_hosts
ssh-keygen -H
rm .ssh/known_hosts.old
$ ssh -o StrictHostKeychecking=no hostname
This will cause the check to be skipped and the remote host's key to automatically be added on first login. (There's also the option CheckHostIP, but it doesn't seem to actually disable the check for whether a key exists at all).
-
5I also like to use UserKnownHostsFile so that the signature isn't remembered on my system. A nice trick:
ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeychecking=no hostname
– metavidaApr 10, 2012 at 21:54
You can disable the checking, but of course that is less secure. In an ideal situation what you should do is get someone that already has access to the machine to grab it's public host key and tell ssh to use it. i.e.: take the output of:
cat /etc/ssh/ssh_host_rsa_key.pub
prepend the hostname of the machine, and add that line to the ~/.ssh/known_hosts file on your machine. You'll end up with something that looks like:
myhost.example.com ssh-rsa AAAAB3Netc...
Alternately, if you just want to grab the fingerprint of the key, which may be easier to transfer over a limited bandwidth channel (like a phone call), you can have your helper run:
ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub
If you just want to temporarily disable host checking, so you can log into a LiveCD system, for instance, rename ~/.ssh/known_hosts
to something else, and then change it back when you're done.
- Add "StrictHostKeyChecking no" to /etc/ssh/ssh_config
- cd ~/.ssh
- rm known_hosts
- ln -s /dev/null known_hosts
Bingo
-
1You do know what kind of attack this question is supposed to prevent, do you?– vonbrandMar 8, 2013 at 18:19
-
This answer should be nuked back to the stone age and wiped from existence. Can someone actually delete it?– netheroApr 11, 2021 at 12:23
-
Absolutely do not do this. You are permanently disabling a very important security feature.– spuderJan 27, 2023 at 5:51