I've written this small utility script:

for h in $SERVER_LIST; do ssh $h "uptime"; done

When a new server is added to $SERVER_LIST, the script is stopped with:

The authenticity of host 'blah.blah.blah (10.10.10.10)' can't be established.
RSA key fingerprint is a4:d9:a4:d9:a4:d9a4:d9:a4:d9a4:d9a4:d9a4:d9a4:d9a4:d9.
Are you sure you want to continue connecting (yes/no)?

I've tried yes:

for h in $SERVER_LIST; do yes | ssh $h "uptime"; done

with no luck.

Is there a way to parametrize ssh to automatically accept any new key?

  • 6
    Lekensteyn's answer is excellent and correct, but I just wanted to note that since ssh is expecting "yes" and yes outputs "y", you might have had better luck with for h in $SERVER_LIST; do yes yes | ssh $h "uptime"; done (note the extra yes, which tells yes what to say instead of "y"). – chazomaticus Apr 18 '12 at 17:54
up vote 203 down vote accepted

Use the StrictHostKeyChecking option, for example:

ssh -oStrictHostKeyChecking=no $h uptime

This option can also be added to ~/.ssh/config, e.g.:

Host somehost
    Hostname 10.0.0.1
    StrictHostKeyChecking no

Note that when the host keys have changed, you'll get a warning, even with this option:

$ ssh -oStrictHostKeyChecking=no somehost uptime
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
31:6f:2a:d5:76:c3:1e:74:f7:73:2f:96:16:12:e0:d8.
Please contact your system administrator.
Add correct host key in /home/peter/.ssh/known_hosts to get rid of this message.
Offending RSA key in /home/peter/.ssh/known_hosts:24
  remove with: ssh-keygen -f "/home/peter/.ssh/known_hosts" -R 10.0.0.1
Password authentication is disabled to avoid man-in-the-middle attacks.
Keyboard-interactive authentication is disabled to avoid man-in-the-middle attacks.
ash: uptime: not found

If your hosts are not often reinstalled, you could make this less secure (but more convenient for often-changing host keys) with the -oUserKnownHostsFile=/dev/null option. This discards all received host keys so it'll never generate the warning.


With 18.04, there's a new possibility: StrictHostKeyChecking=accept-new. From man 5 ssh_config:

If this flag is set to “accept-new” then ssh will automatically
add new host keys to the user known hosts files, but will not
permit connections to hosts with changed host keys.  If this flag
is set to “no” or “off”, ssh will automatically add new host keys
to the user known hosts files and allow connections to hosts with
changed hostkeys to proceed, subject to some restrictions.
  • 6
    This isn't the best solution as it bypasses built-in security tools. ssh-keyscan is preferable, if it's available on your system. – Stefan Lasiewski Nov 11 '15 at 19:06
  • 2
    @StefanLasiewski It allows man in the middle attacks if you are on untrusted networks. For accepting new keys to fixed hosts, the ssh-keyscan approach is more sane. For local virtual machines and other hosts in trusted networks with dynamic/reused IP addresses, the described approach is good enough. – Lekensteyn Nov 11 '15 at 22:49
  • 7
    Just to clarify the difference between the two solutions: The ssh-keyscan solution is only prone to a man-in-the-middle attack the one time ssh-keyscan is being run. The -oStrictHostKeyChecking=no solution is prone to a man-in-the-middle attack every time ssh is being run. – Erik Sjölund Aug 25 '16 at 13:03

You can use the following command to add the fingerprint for a server to your known_hosts

ssh-keyscan -H <ip-address> >> ~/.ssh/known_hosts
ssh-keyscan -H <hostname> >> ~/.ssh/known_hosts

NOTE: Replace < ip-address > and < hostname > with the IP and dns name of the server you want to add.

The only issue with this is that you will end up with some servers in your known_hosts twice. It's not really a big deal, just mentioning. To ensure there are no duplicates, you could remove all the servers first by running the following first:

ssh-keygen -R <ip-address>
ssh-keygen -R <hostname>

So you could run:

for h in $SERVER_LIST; do
    ip=$(dig +search +short $h)
    ssh-keygen -R $h
    ssh-keygen -R $ip
    ssh-keyscan -H $ip >> ~/.ssh/known_hosts
    ssh-keyscan -H $h >> ~/.ssh/known_hosts
done

One thing to keep in mind when removing just to re-add, you are essentially removing the security of verifying the fingerprint. So you would definitely not want to run this script before each execution of your utility script.

  • 1
    running it through sort | uniq and then looking for duplicate host using awk after would make the script capable of detecting changed hosts and warn users only about those, since same host with different keys could mean trouble – Lennart Rolland May 21 '15 at 19:52
  • 2
    You might want to add a note that -H hashes hostnames and addresses. – David Cullen Oct 7 '16 at 19:27

I'm a bit late with this response, but the sensible way would be to do a ssh-keyscan on the new machine before you run the uptime gathering.

ssh-keyscan  <newhost> >> ~/.ssh/known_hosts

Disabling the sanity check for convenience sake sounds like a bad plan, even if you think you're totally in control of the environment.

  • This is actually what I was looking for. Thanks. – user156516 May 31 '16 at 17:33
  • running the above command and not actually checking the host keys against fingerprints you acquired out of band is vulnerable in the exact same way as StrictHostKeyChecking no – code_monk Apr 4 '17 at 20:17
  • 3
    @code_monk : no, it isn't. I opens a one-off opportunity for failure (accepting a key from a wrong host to be added to known hosts). StrictHostKeyChecking no will allow repeat accepts for other machines. – tink Apr 4 '17 at 20:20

In order to add a list of servers automatically we can do below:

Add servers IP in file servers-list

The IPs should be added in below format.

Output of cat servers-list

123.1.2.3
124.1.2.4
123.1.2.5

Change above IPs by replacing yours.

Below command will add all servers from the list.

ssh-keyscan -p61 -H "`cat servers-list`" >> ~/.ssh/known_hosts

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.