216

When i ssh to a machine, sometime i get this error warning and it prompts to say "yes" or "no". This cause some trouble when running from scripts that automatically ssh to other machines.

Warning Message:

The authenticity of host '<host>' can't be established.
ECDSA key fingerprint is    SHA256:TER0dEslggzS/BROmiE/s70WqcYy6bk52fs+MLTIptM.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'pc' (ECDSA) to the list of known hosts.

Is there a way to automatically say "yes" or ignore this?

6
  • 39
    I'd advise against this. You need to work out why you're getting these errors, otherwise you're opening yourself up to a man in the middle attack, which is what these errors are trying to protect you from. Commented Jan 9, 2013 at 10:48
  • 4
    This could be caused by a change in server using that ssh key, or it could be caused by someone sitting between you and the server listening to everything you send/receive. Commented Jan 17, 2013 at 15:31
  • what could be the reason for this error?
    – Ion Utale
    Commented Apr 6, 2019 at 7:14
  • 3
    I disagree with Peter's point. In a large organization trying to get someone else to fix problems like that when you just trying to get your work done is unrealistic. Commented Nov 14, 2019 at 18:46
  • 3
    Many large organizations are exactly the opposite of what @SridharSarnobat is suggesting. You have to make sure the right people solve those sorts of problems, and attempting to work around them just makes things worse. Commented Apr 20, 2020 at 16:46

21 Answers 21

169

Depending on your ssh client, you can set the StrictHostKeyChecking option to no on the command line, and/or send the key to a null known_hosts file. You can also set these options in your config file, either for all hosts or for a given set of IP addresses or host names.

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no

EDIT

As @IanDunn notes, there are security risks to doing this. If the resource you're connecting to has been spoofed by an attacker, they could potentially replay the destination server's challenge back to you, fooling you into thinking that you're connecting to the remote resource while in fact they are connecting to that resource with your credentials. You should carefully consider whether that's an appropriate risk to take on before altering your connection mechanism to skip HostKeyChecking.

Reference.

4
  • 54
    I think it's irresponsible to recommend this without warning about the security implications. superuser.com/a/421084/121091 is a better answer IMO.
    – Ian Dunn
    Commented Sep 2, 2013 at 18:04
  • 7
    @IanDunn I would agree with you in a general SSH client situation, but given that the OP clearly states that he's encountering this problem while running scripts the alternative is breaking the script every time the host key changes (and there are a number of reasons why that might be the case) which the answer you referred to doesn't resolve. That said, it's a valid critique, so I've updated my answer to point out the risk.
    – cori
    Commented Sep 3, 2013 at 1:26
  • 6
    I can't believe so many people have upvoted this answer and also that it is accepted by the questioner. This approach bypasses the security checks and connects it to the remote host. Check if the known_hosts file in the ~/.ssh/ folder has write permission. If not, then use this answer stackoverflow.com/a/35045005/2809294
    – ARK
    Commented Jan 27, 2016 at 18:18
  • As long as you know what you are doing, this is the best solution. I have an internal web site we automatically connect to that has MANY, updating (effectively random) IP addresses. I added this to the ~/.ssh/config and it just works. Mind you, I KNOW that this site is what I think it is and if it is not, bad guys have no advantage, since I know what data is being transferred. Commented Apr 3, 2020 at 17:19
103

Old question that deserves a better answer.

You can prevent interactive prompt without disabling StrictHostKeyChecking (which is insecure).

Incorporate the following logic into your script:

if [ -z "$(ssh-keygen -F $IP)" ]; then
  ssh-keyscan -H $IP >> ~/.ssh/known_hosts
fi

It checks if public key of the server is in known_hosts. If not, it requests public key from the server and adds it to known_hosts.

In this way you are exposed to Man-In-The-Middle attack only once, which may be mitigated by:

  • ensuring that the script connects first time over a secure channel
  • inspecting logs or known_hosts to check fingerprints manually (to be done only once)
4
  • 6
    Or just manage the known_hosts file for all machines as part of your infrastructure configuration setup.
    – Thilo
    Commented Dec 10, 2015 at 1:27
  • 1
    note that ssh-keyscan does not work with ProxyCommand: marc.info/?l=openssh-unix-dev&m=108446567718763&w=2
    – Richlv
    Commented May 13, 2016 at 22:30
  • 1
    it won't work as expected. `ssh-keygen -F $IP` should be "`ssh-keygen -F $IP`" (in quotes), in other case it won't be interpreted as a string
    – avtomaton
    Commented Jun 19, 2019 at 22:14
  • 1
    Or as a oneliner using ssh-kegen return value: ssh-keygen -F $IP >/dev/null || ssh-keyscan -H $IP >> ~/.ssh/known_hosts
    – Gohu
    Commented Jul 5, 2019 at 12:38
46

To disable (or control disabling), add the following lines to the beginning of /etc/ssh/ssh_config...

Host 192.168.0.*
   StrictHostKeyChecking=no
   UserKnownHostsFile=/dev/null

Options:

  • The Host subnet can be * to allow unrestricted access to all IPs.
  • Edit /etc/ssh/ssh_config for global configuration or ~/.ssh/config for user-specific configuration.

See http://linuxcommando.blogspot.com/2008/10/how-to-disable-ssh-host-key-checking.html

Similar question on superuser.com - see https://superuser.com/a/628801/55163

0
26

Make sure ~/.ssh/known_hosts is writable. That fixed it for me.

4
  • 5
    is it secure to allow everybody to write to known_hosts?
    – akaRem
    Commented Apr 16, 2015 at 19:29
  • 3
    @akaRem definitely not. Usually you want it to be only writable to the user who owns that .ssh folder.
    – 2rs2ts
    Commented Apr 28, 2015 at 21:45
  • permissions 0400 are optimal (please correct me anyone) however in my case the issue was simply that the .ssh folder for my user had its ownership changed- ergo invalidating my own 0400 permissions. sudo changing the ownership back to me resolved my issue. Commented May 5, 2015 at 1:34
  • This one fixed the issue for me.
    – Sivaji
    Commented Mar 7, 2020 at 7:39
20

The best way to go about this is to use 'BatchMode' in addition to 'StrictHostKeyChecking'. This way, your script will accept a new hostname and write it to the known_hosts file, but won't require yes/no intervention.

ssh -o BatchMode=yes -o StrictHostKeyChecking=no [email protected] "uptime"
0
13

This warning is issued due the security features, do not disable this feature.

It's just displayed once.

If it still appears after second connection, the problem is probably in writing to the known_hosts file. In this case you'll also get the following message:

Failed to add the host to the list of known hosts 

You may fix it by changing owner of changing the permissions of the file to be writable by your user.

sudo chown -v $USER ~/.ssh/known_hosts
1
  • Making sure known_hosts is only writable by the ssh user adds a layer of security to your process. Commented Jan 31 at 18:31
12

Edit your config file normally located at '~/.ssh/config', and at the beggining of the file, add the below lines

Host *
    User                   your_login_user
    StrictHostKeyChecking  no
    IdentityFile          ~/my_path/id_rsa.pub

User set to your_login_user says that this settings belongs to your_login_user
StrictHostKeyChecking set to no will avoid the prompt
IdentityFile is path to RSA key

This works for me and my scripts, good luck to you.

2
9

Do this -> chmod +w ~/.ssh/known_hosts. This adds write permission to the file at ~/.ssh/known_hosts. After that the remote host will be added to the known_hosts file when you connect to it the next time.

0
8

Ideally, you should create a self-managed certificate authority. Start with generating a key pair: ssh-keygen -f cert_signer

Then sign each server's public host key: ssh-keygen -s cert_signer -I cert_signer -h -n www.example.com -V +52w /etc/ssh/ssh_host_rsa_key.pub

This generates a signed public host key: /etc/ssh/ssh_host_rsa_key-cert.pub

In /etc/ssh/sshd_config, point the HostCertificate to this file: HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub

Restart the sshd service: service sshd restart

Then on the SSH client, add the following to ~/.ssh/known_hosts: @cert-authority *.example.com ssh-rsa AAAAB3Nz...cYwy+1Y2u/

The above contains:

  • @cert-authority
  • The domain *.example.com
  • The full contents of the public key cert_signer.pub

The cert_signer public key will trust any server whose public host key is signed by the cert_signer private key.

Although this requires a one-time configuration on the client side, you can trust multiple servers, including those that haven't been provisioned yet (as long as you sign each server, that is).

For more details, see this wiki page.

5

With reference to Cori's answer, I modified it and used below command, which is working. Without exit, remaining command was actually logging to remote machine, which I didn't want in script

ssh -o StrictHostKeyChecking=no user@ip_of_remote_machine "exit"
4

Add these to your /etc/ssh/ssh_config

Host *
UserKnownHostsFile=/dev/null
StrictHostKeyChecking=no
1
2

Generally this problem occurs when you are modifying the keys very oftenly. Based on the server it might take some time to update the new key that you have generated and pasted in the server. So after generating the key and pasting in the server, wait for 3 to 4 hours and then try. The problem should be solved. It happened with me.

2

For anyone who finds this and is simply looking to prevent the prompt on first connection, but still wants ssh to strictly check the key on subsequent connections (trust on first use), you can set StrictHostKeyChecking to accept-new in ~/.ssh/config, which will do what you're looking for. You can read more about it in man ssh_config. I strongly discourage disabling key checking altogether.

1

The following steps are used to authenticate yourself to the host

  1. Generate a ssh key. You will be asked to create a password for the key
ssh-keygen -f ~/.ssh/id_ecdsa -t ecdsa -b 521

(above uses the recommended encryption technique)

  1. Copy the key over to the remote host
ssh-copy-id -i ~/.ssh/id_ecdsa user@host

N.B the user @ host will be different to you. You will need to type in the password for this server, not the keys password.

  1. You can now login to the server securely and not get an error message.
ssh user@host

All source information is located here: ssh-keygen

1

I was trying to add a SSH key for Github and was facing the same error despite of doing everything correctly and having appropriate permission for known_hosts file too.

Here's what I was missing and what fixed it. While adding the public key on Github, you have to make sure that key name is one of the following -

  • id_rsa.pub
  • id_ecdsa.pub
  • id_ed25519.pub

That's what I was doing wrong. So maybe check that once while adding the key on Github.

Link for docs - https://docs.github.com/en/authentication/connecting-to-github-with-ssh/checking-for-existing-ssh-keys#checking-for-existing-ssh-keys

0

Run this in host server it's premonition issue

chmod -R 700 ~/.ssh
1
  • are you asking people to change the permissions on authorized_keys and public keys from 644 to 700 ? And private key from 600 to 700 ?
    – nurettin
    Commented Apr 29, 2019 at 11:02
0

I had the same error and wanted to draw attention to the fact that - as it just happened to me - you might just have wrong privileges.
You've set up your .ssh directory as either regular or root user and thus you need to be the correct user. When this error appeared, I was root but I configured .ssh as regular user. Exiting root fixed it.

0

This is trying to establish password-less authentication. So, if you try to run that command manually once, it will ask to provide the password there. After entering password, it saves that password permanently, and it will never ask again to type 'yes' or 'no'.

0

For me the reason is that I have wrong permission on ~/.ssh/known_hosts.

I have no write permission on known_hosts file. So it ask me again and again.

-1

In my case, the host was unkown and instead of typing yes to the question are you sure you want to continue connecting(yes/no/[fingerprint])? I was just hitting enter .

0
-3

I solve the issue which gives below written error:
Error:
The authenticity of host 'XXX.XXX.XXX' can't be established.
RSA key fingerprint is 09:6c:ef:cd:55:c4:4f:ss:5a:88:46:0a:a9:27:83:89.

Solution:
1. install any openSSH tool.
2. run command ssh
3. it will ask for do u add this host like. accept YES.
4. This host will add in the known host list.
5. Now you are able to connect with this host.

This solution is working now......

3
  • This does not answer the question. The original (very old) question was about the ability to automatically confirm such prompts via script.
    – MasterAM
    Commented Sep 12, 2013 at 12:00
  • 1
    If it worked for him maybe it works for others. No need to downvote something that is actually useful
    – Mbotet
    Commented Feb 25, 2019 at 11:29
  • running "ssh" is not working. It is showing for options usage: ssh [..][..][..][user@]hostname [command] Commented Jun 19, 2019 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.