I've set up a few headless Raspberry Pi systems using a Raspbian system image lately. They default to using the zeroconf domain name raspberrypi.local. Before I can change it, I have to connect to the new server with SSH, which always barks at me:

> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

and won't connect until I open the known_hosts file and delete the previous entry. Then when it does connect, it automatically adds a new entry for raspberrypi.local to mess things up next time.

I understand and appreciate the logic of checking the keys and automatically adding new ones, but I think for this specific case it doesn't make sense. I would never be connecting to a server called raspberrypi.local unless it was a new server I just plugged in, and in that case it will never have a known trustworthy key.

I can see from the known_hosts specification that I can set a wildcard on the address side (ie. accept this key from any address in this range) but what I want to do is set a wildcard on the key side (accept any key from this particular domain name). Or better yet, just don't check keys from this domain name at all.

Is there any way to tell known_hosts to ignore (pass without checking keys from) a single specific domain name?

1 Answer 1


Try this in your ssh_config, this prevents ssh from saving the key, but only for this hostname.

Host raspberrypi.local
  UserKnownHostsFile /dev/null

The manual also mentions StrictHostKeyChecking:

If this flag is set to “no” or “off”, ssh will automatically add new host keys to the user known hosts files and allow connections to hosts with changed hostkeys to proceed, subject to some restrictions.

But I found no details on those restriction, and you don't want to save the hostkey anyway.

  • This is great. It still gives a warning and makes me type "yes" to continue, and it still says it added the key to the list of known hosts, but the actual known_hosts file doesn't change. I turned off StrictHostKeyChecking and it no longer gives a warning or makes me type "yes", but it still erroneously says added to the list of known hosts. Close enough though.
    – Robert
    May 28, 2021 at 15:37
  • 1
    Well, it does write the key to /dev/null.
    – RalfFriedl
    May 28, 2021 at 15:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .