I would like to disable strict host key checking in ssh for Ubuntu 11.04. How to do it?

  • 11
    Hi karthick87, I hope you understand the security implications of making that change ;) – Panther Dec 13 '11 at 16:18
  • 1
    It should be noted however, that you want to know if a host key has changed. That is a big red flag that someone may be spoofing the host. So UserKnownHostFile /dev/null is a really bad idea. – user274148 Apr 25 '14 at 13:48
  • 6
    SSH is used not only for remote connections, you know. All hosts I'm connecting to are in heap on my table and share the same IP, so I always have the new host warning. – Barafu Albino Sep 10 '14 at 8:34
  • If you just want to remove the message for a particular host, delete the corresponding line ~/.ssh/known_hosts. – stackexchanger Feb 27 '16 at 3:32
  • 2
    If you just need to do a one-time connect without errors: ssh -o UserKnownHostsFile=/dev/null – odinho - Velmont Aug 29 '17 at 9:35

In your ~/.ssh/config (if this file doesn't exist, just create it):

Host *
    StrictHostKeyChecking no

This will turn it off for all hosts you connect to. You can replace the * with a hostname pattern if you only want it to apply to some hosts.

Make sure the permissions on the file restrict access to yourself only:

sudo chmod 400 ~/.ssh/config
| improve this answer | |
  • 2
    There is no file named config in my home directory. – karthick87 Dec 14 '11 at 14:40
  • 5
    Make one - the entire contents of the file are in my quote above. Note it's in the .ssh subdirectory of your homedir as well. – Caesium Dec 14 '11 at 14:44
  • Is the indentation required? My entries look like blocks divided by a empty line. – Andi Giga Jun 20 '17 at 10:04
  • 4
    This is unwise in many cases, often you just want to disable it once: ssh -o UserKnownHostsFile=/dev/null – odinho - Velmont Aug 29 '17 at 9:34
  • 3
    mkdir -p ~/.ssh && echo "Host *" > ~/.ssh/config && echo " StrictHostKeyChecking no" >> ~/.ssh/config – Sankarganesh Eswaran Apr 25 '18 at 12:24

Rather than adding it to your ~/.ssh/config file for all Host *, it would be a safer to specify a particular host.

You can also pass a parameter on the command-line like this:

ssh -o StrictHostKeyChecking=no yourHardenedHost.com
| improve this answer | |
  • Note that you generally only need to do this once per host since it says this the first time: Warning: Permanently added 'frxxx.blaps.net,' (RSA) to the list of known hosts. – MarkHu Jul 24 '13 at 0:49
  • 29
    That won't work. It should be ssh -o UserKnownHostsFile=/dev/null instead. – qwertzguy Oct 29 '14 at 2:51
  • 2
    @qwertzguy It does work. Your option will make it so that the host key is lost each time, which is useful and more secure, but not what the question asked for. – Jon Bentley Nov 30 '15 at 0:04
  • @qwertzguy Could you add this as an answer, yours is really the best for quick'n'dirty "just connect I know what I'm doing"? Didn't wanna ninja-steal your answer. – odinho - Velmont Aug 29 '17 at 9:32
  • 2
    use both works for me, ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no – netawater Nov 12 '17 at 5:35

It's worth pointing out that setting in your ssh config:

StrictHostKeyChecking no

Will mean hostkeys are still added to .ssh/known_hosts - you just won't be prompted about whether you trust them, but should hosts change I'm willing to bet you'll get the big warning about it. You can work around this problem by adding another parameter:

UserKnownHostsFile /dev/null

This will add all these "newly discovered" hosts to the trash bin. If a host key changes, no troubles.

I would be remiss not to mention that circumventing these warnings on hostkeys has obvious security ramifications - you should be careful that you're doing it for the right reasons & that what you're connecting to actually is what you mean to connect to and not a malicious host, since at this point you've eroded a major part of the security in ssh as a solution.

For example if you were to try and set this with the commandline, the full command would be:

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null user@host

That would be silly though - given that the working examples above for ssh config files is likely to make more sense in all cases.

| improve this answer | |
  • 1
    You're correct, you do get the big warning – Freedom_Ben Jan 20 '14 at 17:35
  • 1
    I think this is the right answer. This works well for connecting to hosts on a private local network. – Steve Davis Jan 14 '15 at 14:39
  • 4
    Could be convenient to have an alias to ssh -o StrictHostKeyChecking=no -o UserKnownHostFiles=/dev/null user@host. In my case I use issh to connect to hosts where I know the host key changes. – RubenLaguna May 2 '16 at 13:53
  • 1
    @ecerulm - just a small typo: it's UserKnownHostsFile not UserKnownHostFiles. – Grey Panther Oct 2 '17 at 10:16
  • like a Gem, finally someone understands the generosity in completion and conclusion – sg28 May 16 at 0:04

FYI. I prefer to disable host checking just when using cssh.

alias cssh='ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'
| improve this answer | |
  • 1
    cssh or ssh? – kenorb Jan 16 '14 at 14:29
  • 1
    Maybe he uses cssh.sourceforge.net – MarkHu Jan 31 '14 at 3:22
  • 1
    Am I wrong, or is the second -o unnecessary? – yckart Nov 22 '16 at 2:15
  • 1
    alias relay='ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null 11086695@ -p 2222' work for me – arganzheng Jul 25 '18 at 8:12

If you want to disable on a one time basis use:

ssh -o UserKnownHostsFile=/dev/null

That will work also if the host key changes and will make sure not to save the key as trusted for added security.

| improve this answer | |

From what it sounds like,

NoHostAuthenticationForLocalhost yes

may be good enough, for you. AND you'd still be able to maintain that semblance of security.

| improve this answer | |

https://askubuntu.com/a/87452/129227 suggest to modify the config file which helps. But instead of opening things up for any host I wanted this to be done per host. The script below helps automating the process:

example call

./sshcheck somedomain site1 site2 site3

sshcheck script

# WF 2017-08-25
# check ssh access to bitplan servers

#ansi colors
green='\033[0;32m' # '\e[1;32m' is too bright for white bg.

# a colored message 
#   params:
#     1: l_color - the color of the message
#     2: l_msg - the message to display
color_msg() {
  local l_color="$1"
  local l_msg="$2"
  echo -e "${l_color}$l_msg${endColor}"

# error
#   show an error message and exit
#   params:
#     1: l_msg - the message to display
error() {
  local l_msg="$1"
  # use ansi red for error
  color_msg $red "Error: $l_msg" 1>&2
  exit 1

# show the usage
usage() {
  echo "usage: $0 domain sites"
  exit 1 

# check the given server
checkserver() {
  local l_server="$1"
  grep $l_server $sconfig > /dev/null
  if [ $? -eq 1 ]
    color_msg $blue "adding $l_server to $sconfig"
    today=$(date "+%Y-%m-%d")
    echo "# added $today by $0"  >> $sconfig
    echo "Host $l_server" >> $sconfig
    echo "   StrictHostKeyChecking no" >> $sconfig
    echo "   userKnownHostsFile=/dev/null" >> $sconfig
    echo "" >> $sconfig
    color_msg $green "$l_server found in $sconfig"
  ssh -q $l_server id > /dev/null
  if [ $? -eq 0 ]
    color_msg $green "$l_server accessible via ssh"
    color_msg $red "ssh to $l_server failed" 
    color_msg $blue "shall I ssh-copy-id credentials to $l_server?"
    read answer
    case $answer in
      y|yes) ssh-copy-id $l_server

# check all servers
checkservers() {
me=$(hostname -f)
for server in $(echo $* | sort)
  case $os in
   # Mac OS X
     pingoption=" -t1";;
    *) ;;

  pingresult=$(ping $pingoption -i0.2 -c1 $server)
  echo $pingresult | grep 100 > /dev/null
  if [ $? -eq 1 ]
    checkserver $server
    checkserver $server.$domain
    color_msg $red "ping to $server failed"

# check configuration
checkconfig() {
  if [ -f $sconfig ]
    color_msg $green "$sconfig exists"
    ls -l $sconfig


case  $# in
  0) usage ;;
  1) usage ;;
    color_msg $blue "checking ssh configuration for domain $domain sites $*"
    checkservers $* 
| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.