Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some cloud boxes that change their IP frequently.

I ssh using the hostname but have to edit the known_hosts file every time the server launches because of this error message:

Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is…

Aside from any security risks and such that are associated with what I want to do, is there a way to either ignore this error or overwrite the known_hosts file automatically such that I don't always have to edit it myself?

share|improve this question
up vote 15 down vote accepted

Edit your ssh_config file and add change this line:

CheckHostIP no

CheckHostIP defaults to 'yes'. What this does is to do just the kind of check you're failing. Turning it off means it just trusts that the IP is variable, and will to key-checking against the hostname.

share|improve this answer
marked right amongst other similar answers for proper code formatting. – coneybeare Oct 21 '10 at 22:41

Addition: you could try only disabling the CheckHostIP check for that name:

Host *
  [ global settings .. ]

  CheckHostIP no
share|improve this answer
This is the best option to reduce the security impact of disabling IP-checking. – Espo Oct 22 '10 at 12:58

You can set StrictHostKeyChecking=no in your ssh client configuration (i.e. The ~/ssh/config file on the machine that you connect from), to ignore the warning.

share|improve this answer

You could put CheckHostIP no into your ~/.ssh/config file, but that leaves you open to spoofing attacks. If you're not concerned about that, then this setting should turn off the known_hosts check.

share|improve this answer

I use these dodgy options to work around this problem. (My host's public key is regenerated quite often. so this removes the IP and Key check)

ssh remoteServerName -l username -o "UserKnownHostsFile=/dev/null"

You can also just use this if the Key stays the same but the IP changes:

ssh remoteServerName -l username -o "CheckHostIP=no"
share|improve this answer

Make known_hosts read-only.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.