Is there a way to temporarily ignore my ~/.ssh/known_hostsfile?

mbp:~ alexus$ ssh
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
Please contact your system administrator.
Add correct host key in /Users/alexus/.ssh/known_hosts to get rid of this message.
Offending RSA key in /Users/alexus/.ssh/known_hosts:155
RSA host key for has changed and you have requested strict checking.
Host key verification failed.
mbp:~ alexus$ 


.. by a few answer(s)/comment(s) i realize that my question is a bit misleading, so short it is expected behavior), so it's normal (in my case) there is a valid reason behind it on why I want to see "ignore it")

  • 9
    You're asking the wrong question. You should not "ignore" the problem; you should figure out what is going on and solve it. – Michael Hampton Dec 7 '13 at 20:07
  • Why is this expected behavior? – Thorbjørn Ravn Andersen Apr 14 '14 at 21:23
  • 7
    I can't speak for the user, but one example would be a situation where you are developing a automated install process (such as a kickstart), where your iterative workflow involves building, connecting, testing, modifying the build process, and rebuilding from scratch over and over again. – Goladus Apr 17 '15 at 20:30
  • 9
    @MichaelHampton - I get this all the time as VMware and VirtualBox recycles IP addresses for guests. For me, it is the correct question :) – jww Jul 31 '15 at 9:26
  • FWIW I keep searching for this answer because I have a system in my LAN where I use a dropbear (with a different host key) to enter the disk encryption password during startup. – Zulan Nov 22 '15 at 17:33

You can use ssh -o StrictHostKeyChecking=no to turn off checking known_hosts momentarily. But I'd advise against this. You should really check why the host key has changed.

Another option is to add a specific entry to your ~/.ssh/config for the host in question. This might be valid approach if you have a certain host which generates new host keys every time it reboots and it gets rebooted for a valid reason several times a day.

Host <your problematic host>
  StrictHostKeyChecking no
  • that is expected behavior) so it's normal (in my case) – alexus Dec 7 '13 at 20:22
  • @alexus If it's "expected", then you can apply the option to a specific hostname/IP for which you expect it to happen. – chrylis Dec 7 '13 at 20:25
  • @alexus And remember that if you do this, you pretty much lose all the protection that ssh provides. You may as well be using telnet, as it would be trivial for someone to MITM you and capture all your traffic. – Michael Hampton Dec 7 '13 at 20:44
  • 1
    Single letter spelling error: advice is a noun; you want the verb form, advise. – TRiG Feb 4 '14 at 11:04
  • This no longer works (at least for OpenSSH_5.3p1) – draeath Jan 12 '17 at 16:36

To completely ignore your known hosts file in a POSIX environment, set the GlobalKnownHostsFile and UserKnownHostsFile options to /dev/null:

ssh -o GlobalKnownHostsFile=/dev/null -o UserKnownHostsFile=/dev/null user@host

Setting the StrictHostKeyChecking=no option will allow you to connect but SSH will still show a warning:

ssh -o StrictHostKeyChecking=no user@host

As others have noted, it's probably better to address the underlying issue. You could consider SSH certificate authentication to verify hosts, for example.

  • 1
    This can be a better answer than the currently highest upvoted one because it allows to use password authentication which would be disabled otherwise (of course, you should understand what exactly you are doing before typing in your password...) – VZ. Apr 8 '15 at 21:55

If you have reinstalled the server and therefore the Identification has changed, you should just delete the specified line 155 from /Users/alexus/.ssh/known_hosts and go ahead.

If you switch between different private networks, you should use hostnames to connect instead, as the ssh client will also save keys depending on the hostname. Add something like this to your /etc/hosts: server1 server2

and then use ssh server1 when connected to subnet 1 and ssh server2 when connected to subnet2. This way, both servers can have different hostkeys.

  • What if you switch between two private networks and connect to two same IP? – alexus Dec 7 '13 at 22:51
  • 1
    I've edited my answer. – etagenklo Dec 7 '13 at 23:05
  • 2
    @alexus Then you need IPv6 :) But that would have been useful information in your original question. – Michael Hampton Dec 7 '13 at 23:06

-o StrictHostKeyChecking=no only works if host isn't already present in known_hosts file.

I think it is cleaner (no warnings), if you expect hosts key to change maybe due to vm cloning, to enforce ignoring of those kind of hosts like this:

# Handle possible SSH key changes
host_key=$(ssh-keyscan -t rsa ${host_ip})
grep "${host_key}" ~/.ssh/known_hosts >/dev/null || {
    ssh-keygen -R ${host_ip}
    echo ${host_key} >>  ~/.ssh/known_hosts

# connect as normal way
ssh root@${host_ip} "hostname"

Some people say its not right, you don't shold do this and so on, but i need this also to test couple of embedded devices over and over again. You need to disable StrictHostKeyChecking=no, this is right, but also reset known hosts file to /dev/null. Here an exemple with autologin and ps on remote device.

sshpass -p pass ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null user@host 'ps ax'

Log in to all of your servers, (and if RedHat) rm -f /etc/ssh/ssh_host_* and then restart SSHD.

This will create new SSH host keys that do not need to be ignored.

I can think of only one instance where SSH keys cloned on multiple servers is not only desired but also does not throw any warnings. Multiples of one A record. All hosts with the A record have the same key.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.