Can I set SSH known_hosts to ignore a specific hostname?

Question

I've set up a few headless Raspberry Pi systems using a Raspbian system image lately. They default to using the zeroconf domain name raspberrypi.local. Before I can change it, I have to connect to the new server with SSH, which always barks at me:

> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> @      WARNING: POSSIBLE DNS SPOOFING DETECTED!           @
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

and won't connect until I open the known_hosts file and delete the previous entry. Then when it does connect, it automatically adds a new entry for raspberrypi.local to mess things up next time.

I understand and appreciate the logic of checking the keys and automatically adding new ones, but I think for this specific case it doesn't make sense. I would never be connecting to a server called raspberrypi.local unless it was a new server I just plugged in, and in that case it will never have a known trustworthy key.

I can see from the known_hosts specification that I can set a wildcard on the address side (ie. accept this key from any address in this range) but what I want to do is set a wildcard on the key side (accept any key from this particular domain name). Or better yet, just don't check keys from this domain name at all.

Is there any way to tell known_hosts to ignore (pass without checking keys from) a single specific domain name?

Answer 1

Try this in your ssh_config, this prevents ssh from saving the key, but only for this hostname.

Host raspberrypi.local
  UserKnownHostsFile /dev/null

The manual also mentions StrictHostKeyChecking:

If this flag is set to “no” or “off”, ssh will automatically add new host keys to the user known hosts files and allow connections to hosts with changed hostkeys to proceed, subject to some restrictions.

But I found no details on those restriction, and you don't want to save the hostkey anyway.