Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had to solve a fringe case lately where I had to add a number of server fingerprints to a user's known_hosts (the authorization is performed with a keypair). I thought the easiest solution would be to just call

yes yes | ssh *login@host*

. Surprisingly (to me at least), this doesn't work: ssh still asks whether to add the fingerprint, and requires manual input.

My question is: why is this the case, as in, what is the mechanism underlying this behavior?

share|improve this question
up vote 4 down vote accepted

For this prompt, ssh does not use the stdin & stdout streams – to avoid the prompt being mixed up with the remote command's input/output. (Imagine running ssh host cat something.tar | tar x, and suddenly having tar x complain about garbage in its input.)

Instead, ssh opens the special device /dev/tty, which always points to its "controlling terminal", writes the prompt there, and reads the answer from it.

For your problem specifically, OpenSSH comes with ssh-keyscan, a tool to grab public keys of many servers at once.

ssh-keyscan host1 host2 host3 >> ~/.ssh/known_hosts

(I'm not sure whether you meant known_hosts, or actually needed authorized_keys here.)

For the general case, the expect utility can be used to automate programs that normally do their I/O via tty.

share|improve this answer
Gah... of course I meant known_hosts, sorry about that. I suspected this might be something to do with /dev/tty, thanks for the clarification - and for the very comprehensive answer, addressing both the special and the general case. – mikołak Jan 9 '13 at 23:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .