Is there a way to temporarily ignore my ~/.ssh/known_hostsfile?

mbp:~ alexus$ ssh
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
Please contact your system administrator.
Add correct host key in /Users/alexus/.ssh/known_hosts to get rid of this message.
Offending RSA key in /Users/alexus/.ssh/known_hosts:155
RSA host key for has changed and you have requested strict checking.
Host key verification failed.
mbp:~ alexus$ 


.. by a few answer(s)/comment(s) i realize that my question is a bit misleading, so short it is expected behavior), so it's normal (in my case) there is a valid reason behind it on why I want to see "ignore it")

  • 10
    You're asking the wrong question. You should not "ignore" the problem; you should figure out what is going on and solve it. – Michael Hampton Dec 7 '13 at 20:07
  • 13
    I can't speak for the user, but one example would be a situation where you are developing a automated install process (such as a kickstart), where your iterative workflow involves building, connecting, testing, modifying the build process, and rebuilding from scratch over and over again. – Goladus Apr 17 '15 at 20:30
  • 14
    @MichaelHampton - I get this all the time as VMware and VirtualBox recycles IP addresses for guests. For me, it is the correct question :) – user145545 Jul 31 '15 at 9:26
  • 1
    FWIW I keep searching for this answer because I have a system in my LAN where I use a dropbear (with a different host key) to enter the disk encryption password during startup. – Zulan Nov 22 '15 at 17:33
  • 1
    @jww This is the wrong question/solution for your scenario. Instead you should be configuring SSH to ignore the IP address but still check the host key. See for example here – Jon Bentley Mar 5 '19 at 13:36

You can use ssh -o StrictHostKeyChecking=no to turn off checking known_hosts momentarily. But I'd advise against this. You should really check why the host key has changed.

Another option is to add a specific entry to your ~/.ssh/config for the host in question. This might be valid approach if you have a certain host which generates new host keys every time it reboots and it gets rebooted for a valid reason several times a day.

Host <your problematic host>
  StrictHostKeyChecking no
  • that is expected behavior) so it's normal (in my case) – alexus Dec 7 '13 at 20:22
  • 1
    @alexus If it's "expected", then you can apply the option to a specific hostname/IP for which you expect it to happen. – chrylis -cautiouslyoptimistic- Dec 7 '13 at 20:25
  • 2
    @alexus And remember that if you do this, you pretty much lose all the protection that ssh provides. You may as well be using telnet, as it would be trivial for someone to MITM you and capture all your traffic. – Michael Hampton Dec 7 '13 at 20:44
  • 1
    This no longer works (at least for OpenSSH_5.3p1) – draeath Jan 12 '17 at 16:36
  • -o StrictHostKeyChecking=no removes the ability to log in with a password. Doesn't the lack of a flag for this go directly against unix principles of allowing the user to force behavior? I'm currently trying to login to a local machine with a local IP. The host key changed because I reformatted said machine. Everything here makes sense and nothing is a security risk under the circumstances. – Wowfunhappy Sep 26 '19 at 23:28

To completely ignore your known hosts file in a POSIX environment, set the GlobalKnownHostsFile and UserKnownHostsFile options to /dev/null:

ssh -o GlobalKnownHostsFile=/dev/null -o UserKnownHostsFile=/dev/null user@host

Setting the StrictHostKeyChecking=no option will allow you to connect but SSH will still show a warning:

ssh -o StrictHostKeyChecking=no user@host

As others have noted, it's probably better to address the underlying issue. You could consider SSH certificate authentication to verify hosts, for example.

  • 3
    This can be a better answer than the currently highest upvoted one because it allows to use password authentication which would be disabled otherwise (of course, you should understand what exactly you are doing before typing in your password...) – VZ. Apr 8 '15 at 21:55
  • 1
    I'm a little confused here: shouldn't you also use -o StrictHostKeyChecking=no in addition to the -o GlobalKnownHostsFile=/dev/null -o UserKnownHostsFile=/dev/null options?--for a final answer of: ssh -o GlobalKnownHostsFile=/dev/null -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user@host? – Gabriel Staples Nov 1 '19 at 16:28
  • Related writeup I found online: shellhacks.com/disable-ssh-host-key-checking – Gabriel Staples Nov 1 '19 at 16:31
  • -o UserKnownHostsFile=/dev/null (in combination with StrictHostKeyChecking=no) allowed me to silence WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED which was happening when the host was being powered off and on again (and in this case regenerating keys). Thanks! – fabiomaia Sep 17 '20 at 8:55

If you have reinstalled the server and therefore the Identification has changed, you should just delete the specified line 155 from /Users/alexus/.ssh/known_hosts and go ahead.

If you switch between different private networks, you should use hostnames to connect instead, as the ssh client will also save keys depending on the hostname. Add something like this to your /etc/hosts: server1 server2

and then use ssh server1 when connected to subnet 1 and ssh server2 when connected to subnet2. This way, both servers can have different hostkeys.

  • What if you switch between two private networks and connect to two same IP? – alexus Dec 7 '13 at 22:51
  • 1
    I've edited my answer. – etagenklo Dec 7 '13 at 23:05
  • 2
    @alexus Then you need IPv6 :) But that would have been useful information in your original question. – Michael Hampton Dec 7 '13 at 23:06

-o StrictHostKeyChecking=no only works if host isn't already present in known_hosts file.

I think it is cleaner (no warnings), if you expect hosts key to change maybe due to vm cloning, to enforce ignoring of those kind of hosts like this:

# Handle possible SSH key changes
host_key=$(ssh-keyscan -t rsa ${host_ip})
grep "${host_key}" ~/.ssh/known_hosts >/dev/null || {
    ssh-keygen -R ${host_ip}
    echo ${host_key} >>  ~/.ssh/known_hosts

# connect as normal way
ssh root@${host_ip} "hostname"

Some people say its not right, you don't shold do this and so on, but i need this also to test couple of embedded devices over and over again. You need to disable StrictHostKeyChecking=no, this is right, but also reset known hosts file to /dev/null. Here an exemple with autologin and ps on remote device.

sshpass -p pass ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null user@host 'ps ax'

My alias:

ssh='ssh -q -o StrictHostKeyChecking=no -o GlobalKnownHostsFile=/dev/null -o UserKnownHostsFile=/dev/null'
  • 5
    You should never ignore such messages 100% of the time. Doing so exposes you to MITM attacks. – Michael Hampton Dec 31 '20 at 20:23
  • In addition to what Michael said: while you might live in a danger with it, you better never recommend this wrong approach to anybody else, at least without BIG RED DISCLAIMER this is very insecure and dangerous. – Nikita Kipriyanov Jan 16 at 15:34

Log in to all of your servers, (and if RedHat) rm -f /etc/ssh/ssh_host_* and then restart SSHD.

This will create new SSH host keys that do not need to be ignored.

I can think of only one instance where SSH keys cloned on multiple servers is not only desired but also does not throw any warnings. Multiples of one A record. All hosts with the A record have the same key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.