Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Linux man page on ssh say about host based authentication works as SSH server must be able to verify the client's host key (see the description of /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts, below) for login to be permitted. Which I understand ~/.ssh/known_hosts contain host keys of SSH server accessed by client.

As such in Key-based authentication where identity private keys are read from ~/.ssh/id_rsa and ~/.ssh/id_dsa, how can I force to look for keys in different location in host based authentication with only key ~/.ssh/known_hosts.

In key based auth. we can point to a different location using ssh -i /new/path/to/id_rsa <server IP>, and would like to know how it is feasible with host based auth.

Thanks in advance!

share|improve this question
up vote 2 down vote accepted

Your known_hosts files is used by your ssh client to verify the identity of the remote host to which you are connecting. In host-based authentication, the remote server needs to verify the identity of your client host, which has nothing to do with your local known_hosts file.

Your host key comes from /etc/ssh/ssh_host_rsa_key or one of the other similarly named files in /etc/ssh. You set the location of your hostkey using the HostKey directive in /etc/ssh/sshd_config.

Note that this cannot be set per connection. This is a credential that identifies your host.

share|improve this answer
All that is true. But I think the OP still has a valid question, for all that it's not very clearly expressed: where does the server cache the client's host key, and can that be changed? – MadHatter Jul 31 '13 at 19:50
I didn't actually see that in the question. In any case, the answer is that the remote host will look up the host key in /etc/ssh/ssh_known_hosts, which must be maintained by a system administrator. – larsks Jul 31 '13 at 19:51
I agree I rather inferred the question, but that's how I read it. Anyway, you answered mine (+1 for you!) so hopefully you've also answered his/hers. – MadHatter Jul 31 '13 at 19:52

It is not feasible with host-based auth. Host-based auth relies on ssh-keysign which has hard-coded locations of the host keys. In particular, for openssh-6.2p1, in ssh-keysign.c there is:

170   key_fd[i++] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY);
171   key_fd[i++] = open(_PATH_HOST_ECDSA_KEY_FILE, O_RDONLY);
172   key_fd[i++] = open(_PATH_HOST_RSA_KEY_FILE, O_RDONLY);
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.