Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to add to the known_hosts file from the command line as I am creating a puppet manifest to provision a remote server.

I have tried:

"ssh-keyscan -H > /home/ubuntu/.ssh/known_hosts"

But when the server tries to access github:

Failed to add the RSA host key for IP address '' to the list 
of known hosts (/home/ubuntu/.ssh/known_hosts).

I've also tried:

"ssh-keyscan -H, > /home/ubuntu/.ssh/known_hosts"`

But accessing github throws:

Host key verification failed.

I'm sure this is of no additional use but if I ssh my server and then ssh github and follow the steps I get the following message Permanently added ',' (RSA) to the list of known hosts and then it will work perfectly.


share|improve this question
The 'failed to add' message indicates there could be a permissions issue on /home/ubuntu/.ssh/known_hosts. Is it writable by your user? – Aaron Copley Jul 19 '12 at 17:29
You would most likely want >> to append instead of > to overwrite. – Dennis Williamson Jul 20 '12 at 15:12
up vote 9 down vote accepted

We handle this problem by putting the known_hosts file on the puppet server and serving the file directly out of puppet:

  owner => "appuser",
  group => "appuser",
  mode => 755,
  source => "puppet:///modules/ssh/known_hosts",
  require => File["/home/appuser"];

This copies the correctly formatted known_hosts file from the puppet repo, sets the user accordingly, and ensures it has correct permissions. Works well for us.

share|improve this answer
Out of curiosity, why are you not using the sshkey resource to publish key(s) directly to the system wide known_hosts file? – Zoredache Jul 19 '12 at 18:38
@Zoredache Because I'd never heard of that facility before. – sysadmin1138 Jul 19 '12 at 18:43
Ah, I like the sshkey better then replacing the entire file since it allows me to add/remove individual keys and still permitting local changes, which is somewhat needed in my environment. – Zoredache Jul 19 '12 at 18:50
Thanks that work a treat! @Zoredache sshkey looks great but it would be nice if it would let you specify directory/file name! – user71736 Jul 20 '12 at 7:28
sshkey does let you specify the directory/file name. Just use target => "fullpath/to/filename" – Jistanidiot Jan 14 '13 at 18:46

This is mentioned in the comments to the accepted answer, but I just ran into this and thought that this much cleaner solution deserves its own answer.

Puppet's core sshkey type installs keys into the server-wide /etc/ssh/ssh_known_hosts file without having to clobber the whole file. For this case:

sshkey {'github':
  name => '',
  ensure => present,
  key => '[GitHub key (just the part after ssh-rsa, starting with AAA)]',
  type => 'ssh-rsa',

Will install it nicely.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.