194

I would like to disable strict host key checking in ssh for Ubuntu 11.04. How to do it?

  • 10
    Hi karthick87, I hope you understand the security implications of making that change ;) – Panther Dec 13 '11 at 16:18
  • 1
    It should be noted however, that you want to know if a host key has changed. That is a big red flag that someone may be spoofing the host. So UserKnownHostFile /dev/null is a really bad idea. – user274148 Apr 25 '14 at 13:48
  • 4
    SSH is used not only for remote connections, you know. All hosts I'm connecting to are in heap on my table and share the same IP, so I always have the new host warning. – Barafu Albino Sep 10 '14 at 8:34
  • If you just want to remove the message for a particular host, delete the corresponding line ~/.ssh/known_hosts. – stackexchanger Feb 27 '16 at 3:32
  • 2
    If you just need to do a one-time connect without errors: ssh -o UserKnownHostsFile=/dev/null – odinho - Velmont Aug 29 '17 at 9:35
203

In your ~/.ssh/config (if this file doesn't exist, just create it):

Host *
    StrictHostKeyChecking no

This will turn it off for all hosts you connect to. You can replace the * with a hostname pattern if you only want it to apply to some hosts.

Make sure the permissions on the file restrict access to yourself only:

sudo chmod 400 ~/.ssh/config
  • 1
    There is no file named config in my home directory. – karthick87 Dec 14 '11 at 14:40
  • 4
    Make one - the entire contents of the file are in my quote above. Note it's in the .ssh subdirectory of your homedir as well. – Caesium Dec 14 '11 at 14:44
  • Is the indentation required? My entries look like blocks divided by a empty line. – Andi Giga Jun 20 '17 at 10:04
  • 3
    This is unwise in many cases, often you just want to disable it once: ssh -o UserKnownHostsFile=/dev/null – odinho - Velmont Aug 29 '17 at 9:34
  • 1
    mkdir -p ~/.ssh && echo "Host *" > ~/.ssh/config && echo " StrictHostKeyChecking no" >> ~/.ssh/config – Sankarganesh Eswaran Apr 25 '18 at 12:24
163

Rather than adding it to your ~/.ssh/config file for all Host *, it would be a safer to specify a particular host.

You can also pass a parameter on the command-line like this:

ssh -o StrictHostKeyChecking=no yourHardenedHost.com
  • Note that you generally only need to do this once per host since it says this the first time: Warning: Permanently added 'frxxx.blaps.net,10.11.12.13' (RSA) to the list of known hosts. – MarkHu Jul 24 '13 at 0:49
  • 20
    That won't work. It should be ssh -o UserKnownHostsFile=/dev/null instead. – qwertzguy Oct 29 '14 at 2:51
  • 1
    @qwertzguy It does work. Your option will make it so that the host key is lost each time, which is useful and more secure, but not what the question asked for. – Jon Bentley Nov 30 '15 at 0:04
  • @qwertzguy Could you add this as an answer, yours is really the best for quick'n'dirty "just connect I know what I'm doing"? Didn't wanna ninja-steal your answer. – odinho - Velmont Aug 29 '17 at 9:32
  • @odinho-velmont done – qwertzguy Aug 29 '17 at 15:55
92

It's worth pointing out that setting in your ssh config:

StrictHostKeyChecking no

Will mean hostkeys are still added to .ssh/known_hosts - you just won't be prompted about whether you trust them, but should hosts change I'm willing to bet you'll get the big warning about it. You can work around this problem by adding another parameter:

UserKnownHostsFile /dev/null

This will add all these "newly discovered" hosts to the trash bin. If a host key changes, no troubles.

I would be remiss not to mention that circumventing these warnings on hostkeys has obvious security ramifications - you should be careful that you're doing it for the right reasons & that what you're connecting to actually is what you mean to connect to and not a malicious host.

For example if you were to try and set this with the commandline, the full command would be:

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null user@host

That would be silly though - given that the working examples above for ssh config files is likely to make more sense in all cases.

(6 chars edited)

  • 1
    You're correct, you do get the big warning – Freedom_Ben Jan 20 '14 at 17:35
  • 1
    I think this is the right answer. This works well for connecting to hosts on a private local network. – Steve Davis Jan 14 '15 at 14:39
  • 3
    Could be convenient to have an alias to ssh -o StrictHostKeyChecking=no -o UserKnownHostFiles=/dev/null user@host. In my case I use issh to connect to hosts where I know the host key changes. – ecerulm May 2 '16 at 13:53
  • 1
    @ecerulm - just a small typo: it's UserKnownHostsFile not UserKnownHostFiles. – Grey Panther Oct 2 '17 at 10:16
17

FYI. I prefer to disable host checking just when using cssh.

alias cssh='ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'
  • cssh or ssh? – kenorb Jan 16 '14 at 14:29
  • Maybe he uses cssh.sourceforge.net – MarkHu Jan 31 '14 at 3:22
  • Am I wrong, or is the second -o unnecessary? – yckart Nov 22 '16 at 2:15
  • 1
    alias relay='ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null 11086695@172.26.19.19 -p 2222' work for me – arganzheng Jul 25 '18 at 8:12
7

If you want to disable on a one time basis use:

ssh -o UserKnownHostsFile=/dev/null

That will work also if the host key changes and will make sure not to save the key as trusted for added security.

5

From what it sounds like,

NoHostAuthenticationForLocalhost yes

may be good enough, for you. AND you'd still be able to maintain that semblance of security.

1

https://askubuntu.com/a/87452/129227 suggest to modify the config file which helps. But instead of opening things up for any host I wanted this to be done per host. The script below helps automating the process:

example call

./sshcheck somedomain site1 site2 site3

sshcheck script

#!/bin/bash
# WF 2017-08-25
# check ssh access to bitplan servers

#ansi colors
#http://www.csc.uvic.ca/~sae/seng265/fall04/tips/s265s047-tips/bash-using-colors.html
blue='\033[0;34m'  
red='\033[0;31m'  
green='\033[0;32m' # '\e[1;32m' is too bright for white bg.
endColor='\033[0m'

#
# a colored message 
#   params:
#     1: l_color - the color of the message
#     2: l_msg - the message to display
#
color_msg() {
  local l_color="$1"
  local l_msg="$2"
  echo -e "${l_color}$l_msg${endColor}"
}

#
# error
#
#   show an error message and exit
#
#   params:
#     1: l_msg - the message to display
error() {
  local l_msg="$1"
  # use ansi red for error
  color_msg $red "Error: $l_msg" 1>&2
  exit 1
}

#
# show the usage
#
usage() {
  echo "usage: $0 domain sites"
  exit 1 
}

#
# check the given server
#
checkserver() {
  local l_server="$1"
  grep $l_server $sconfig > /dev/null
  if [ $? -eq 1 ]
  then
    color_msg $blue "adding $l_server to $sconfig"
    today=$(date "+%Y-%m-%d")
    echo "# added $today by $0"  >> $sconfig
    echo "Host $l_server" >> $sconfig
    echo "   StrictHostKeyChecking no" >> $sconfig
    echo "   userKnownHostsFile=/dev/null" >> $sconfig
    echo "" >> $sconfig
  else
    color_msg $green "$l_server found in $sconfig"
  fi
  ssh -q $l_server id > /dev/null
  if [ $? -eq 0 ]
  then
    color_msg $green "$l_server accessible via ssh"
  else
    color_msg $red "ssh to $l_server failed" 
    color_msg $blue "shall I ssh-copy-id credentials to $l_server?"
    read answer
    case $answer in
      y|yes) ssh-copy-id $l_server
    esac
  fi
}

#
# check all servers
#
checkservers() {
me=$(hostname -f)
for server in $(echo $* | sort)
do
  os=`uname`
  case $os in
   # Mac OS X
   Darwin*)
     pingoption=" -t1";;
    *) ;;
  esac

  pingresult=$(ping $pingoption -i0.2 -c1 $server)
  echo $pingresult | grep 100 > /dev/null
  if [ $? -eq 1 ]
  then 
    checkserver $server
    checkserver $server.$domain
  else
    color_msg $red "ping to $server failed"
  fi
done
}

#
# check configuration
#
checkconfig() {
#https://askubuntu.com/questions/87449/how-to-disable-strict-host-key-checking-in-ssh
  if [ -f $sconfig ]
  then
    color_msg $green "$sconfig exists"
    ls -l $sconfig
  fi
}

sconfig=~/.ssh/config

case  $# in
  0) usage ;;
  1) usage ;;
  *) 
    domain=$1 
    shift 
    color_msg $blue "checking ssh configuration for domain $domain sites $*"
    checkconfig
    checkservers $* 
    ;;
esac

protected by Byte Commander May 6 '16 at 13:13

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.