Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to disable strict host key checking in ssh for ubuntu 11.04. How to do it?

share|improve this question
8  
Hi karthick87, I hope you understand the security implications of making that change ;) – bodhi.zazen Dec 13 '11 at 16:18
1  
It should be noted however, that you want to know if a host key has changed. That is a big red flag that someone may be spoofing the host. So UserKnownHostFile /dev/null is a really bad idea. – user274148 Apr 25 '14 at 13:48
1  
SSH is used not only for remote connections, you know. All hosts I'm connecting to are in heap on my table and share the same IP, so I always have the new host warning. – Barafu Albino Sep 10 '14 at 8:34
    
If you just want to remove the message for a particular host, delete the corresponding line ~/.ssh/known_hosts. – stackexchanger Feb 27 at 3:32
up vote 84 down vote accepted

In your ~/.ssh/config (if this file doesn't exist, just create it):

Host *
    StrictHostKeyChecking no

This will turn it off for all hosts you connect to. You can replace the * with a hostname pattern if you only want it to apply to some hosts.

Make sure the permissions on the file restrict access to yourself only:

sudo chmod 400 ~/.ssh/config
share|improve this answer
    
There is no file named config in my home directory. – karthick87 Dec 14 '11 at 14:40
1  
Make one - the entire contents of the file are in my quote above. Note it's in the .ssh subdirectory of your homedir as well. – Caesium Dec 14 '11 at 14:44

Rather than adding it to your ~/.ssh/config file for all Host *, it would be a safer to specify a particular host.

You can also pass a parameter on the command-line like this:

ssh -o StrictHostKeyChecking=no yourHardenedHost.com
share|improve this answer
    
Note that you generally only need to do this once per host since it says this the first time: Warning: Permanently added 'frxxx.blaps.net,10.11.12.13' (RSA) to the list of known hosts. – MarkHu Jul 24 '13 at 0:49
6  
That won't work. It should be ssh -o UserKnownHostsFile=/dev/null instead. – qwertzguy Oct 29 '14 at 2:51
    
@qwertzguy It does work. Your option will make it so that the host key is lost each time, which is useful and more secure, but not what the question asked for. – Jon Bentley Nov 30 '15 at 0:04

It's worth pointing out that:

StrictHostKeyChecking no

Will mean hostkeys are still added to .ssh/known_hosts - you just won't be prompted about whether you trust them, but should hosts change I'm willing to bet you'll get the big warning about it. You can work around this problem by adding another parameter:

UserKnownHostsFile /dev/null

This will add all these "newly discovered" hosts to the trash bin. If a host key changes, no troubles.

I would be remiss not to mention that circumventing these warnings on hostkeys has obvious security ramifications - you should be careful that you're doing it for the right reasons & that what you're connecting to actually is what you mean to connect to and not a malicious host.

share|improve this answer
    
You're correct, you do get the big warning – Freedom_Ben Jan 20 '14 at 17:35
    
I think this is the right answer. This works well for connecting to hosts on a private local network. – Steve Davis Jan 14 '15 at 14:39
    
Could be convenient to have an alias to ssh -o StrictHostKeyChecking=no -o UserKnownHostFiles=/dev/null user@host. In my case I use issh to connect to hosts where I know the host key changes. – ecerulm May 2 at 13:53

FYI. I prefer to disable host checking just when using cssh.

alias cssh='cssh -o "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"'
share|improve this answer
    
cssh or ssh? – kenorb Jan 16 '14 at 14:29
    
Maybe he uses cssh.sourceforge.net – MarkHu Jan 31 '14 at 3:22

From what it sounds like,

NoHostAuthenticationForLocalhost yes

may be good enough, for you. AND you'd still be able to maintain that semblance of security.

share|improve this answer

protected by Byte Commander May 6 at 13:13

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.