Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here's my situation; I'm setting up a test harness that will, from a central client, launch a number of virtual machine instances and then execute commands on them via SSH. The virtual machines will have previously unused hostnames and IP addresses, so they won't be in the ~/.ssh/known_hosts file on the central client.

The problem I'm having is that the first SSH command run against a new virtual instance always comes up with an interactive prompt:

The authenticity of host '[hostname] ([IP address])' can't be established.
RSA key fingerprint is [key fingerprint].
Are you sure you want to continue connecting (yes/no)?

Is there a way that I can bypass this and get the new host to be already known to the client machine, maybe by using a public key that's already baked into the virtual machine image ? I'd really like to avoid having to use Expect or whatever to answer the interactive prompt if I can.

share|improve this question
add comment

4 Answers

up vote 30 down vote accepted

Set the StrictHostKeyChecking option to no, either in the config file or via -o.

share|improve this answer
8  
ssh -o StrictHostKeyChecking=no username@hostname.com –  deleted Apr 16 '10 at 5:01
1  
Thanks, Ignacio and cd. –  gareth_bowles Apr 16 '10 at 17:20
3  
This leaves you open to man in the middle attacks, probably not a good idea. –  JasperWallace Sep 23 '13 at 7:23
add comment

IMO, the best way to do this is the following:

ssh-keygen -R [hostname]
ssh-keygen -R [ip_address]
ssh-keygen -R [hostname],[ip_address]
ssh-keyscan -H [hostname],[ip_address] >> ~/.ssh/known_hosts
ssh-keyscan -H [ip_address] >> ~/.ssh/known_hosts
ssh-keyscan -H [hostname] >> ~/.ssh/known_hosts

That will make sure there are no duplicate entries, that you are covered for both the hostname and IP address, and will also hash the output, an extra security measure.

share|improve this answer
    
Why do you need all 3 ssh-keyscan's? Can't you get by with just the first one since it works for both hostname and ip? –  Robert May 24 '13 at 22:00
    
Can you be sure that the machine replying to the ssh-keyscan request is really the one you want to talk to? If not you've opened yourself to a man in the middle attack. –  JasperWallace Sep 23 '13 at 7:24
    
@JasperWallace Yes, for that you need at least the fingerprint or even better the public key, in which case you can add it directly to known_hosts, turning this question moot. If you only have the fingerprint, you will have to write an extra step which verifies the downloaded public key with your fingerprint... –  ufotds Apr 28 at 21:57
add comment

As mentioned in another answer, using key-scan would be the right & unobtrusive way to do it.

ssh-keyscan -t rsa,dsa HOST 2>&1 | sort -u - ~/.ssh/known_hosts > ~/.ssh/tmp_hosts
cat ~/.ssh/tmp_hosts >> ~/.ssh/known_hosts

The above will do the trick to add a host, ONLY if it has not yet been added. It is also not concurrency safe; you must not execute the snippet on the same origin machine more than once at the same time, as the tmp_hosts file can get clobbered, ultimately leading to the known_hosts file becoming bloated...

share|improve this answer
    
Is there a way to check whether the key is in known_hosts before ssh-keyscan? The reason is that it requires some time and additional network connection. –  utapyngo May 23 at 7:49
add comment

You could use ssh-keyscan to grab the public key and append that to your known_hosts

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.