Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had to solve a fringe case lately where I had to add a number of server fingerprints to a user's known_hosts (the authorization is performed with a keypair). I thought the easiest solution would be to just call

yes yes | ssh *login@host*

. Surprisingly (to me at least), this doesn't work: ssh still asks whether to add the fingerprint, and requires manual input.

My question is: why is this the case, as in, what is the mechanism underlying this behavior?

share|improve this question
up vote 4 down vote accepted

For this prompt, ssh does not use the stdin & stdout streams – to avoid the prompt being mixed up with the remote command's input/output. (Imagine running ssh host cat something.tar | tar x, and suddenly having tar x complain about garbage in its input.)

Instead, ssh opens the special device /dev/tty, which always points to its "controlling terminal", writes the prompt there, and reads the answer from it.

For your problem specifically, OpenSSH comes with ssh-keyscan, a tool to grab public keys of many servers at once.

ssh-keyscan host1 host2 host3 >> ~/.ssh/known_hosts

(I'm not sure whether you meant known_hosts, or actually needed authorized_keys here.)

For the general case, the expect utility can be used to automate programs that normally do their I/O via tty.

share|improve this answer
Gah... of course I meant known_hosts, sorry about that. I suspected this might be something to do with /dev/tty, thanks for the clarification - and for the very comprehensive answer, addressing both the special and the general case. – mikołak Jan 9 '13 at 23:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.