3

I am using a tool which relies on ssh to connect to a remote host. Unfortunately this tool does not accept user inputs and when the remote host key is unknown the call hangs forever. Is there an option or a set of options which make the ssh invocation fails when the remote host key is unknown?

4 Answers 4

3

Use -o StrictHostKeyChecking=yes for ssh invocation:

If this flag is set to yes, ssh(1) will never automatically add host keys to the ~/.ssh/known_hosts file, and refuses to connect to hosts whose host key has changed.

The default is ask and this is why you have a problem:

If this flag is set to ask (the default), new host keys will be added to the user known host files only after the user has confirmed that is what they really want to do, and ssh will refuse to connect to hosts whose host key has changed.

0

As a workaround you can check yourself if the host is trusted:

$ ssh-keygen -H -F host.example.com
# Host host.example.com found: line 205 type RSA
...

Note that ssh-keygen exits with 0 in any case here, so you have to check the output:

ssh-keygen -H -F host.example.com |
   grep -q found: || echo "host is not trusted" && exit 2
0

You can use -oBatchMode=yes to fail where user interaction would be required (e.g. asking for a password, checking the remote host key etc.)

-2

You can add default options in ~/.ssh/config such as:

Host *
    StrictHostKeyChecking no

This disables ssh complaining about unknown or changed host keys.

You can limit these options to a set of host by supplying an appropriate host pattern.

4
  • This is generally bad practice wurtel as a key change may be missed and a major threat vector ... ssh-add the host key or use the hostname switch when making new keys May 1, 2015 at 11:29
  • 1
    It is the temporary solution I'm using. But it also makes ssl ignore any change of the host key. That's why I prefer a secure fail-fast solution.
    – Jcs
    May 1, 2015 at 11:37
  • @linuxdev2013 what is the hostname switch? ssh-add is useful for passphrases but he hasn't said he uses them
    – barlop
    May 1, 2015 at 11:53
  • This answer does not provide the solution that is asked for. It does not make ssh fail in the described situation, it makes ssh succeed, which is the direct opposite.
    – 0x89
    Nov 5, 2015 at 10:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .