I'm having an issue with OpenSSH 7.6p1 on a fresh install of Ubuntu 16.04 (a problem that didn't exist on my previous Ubuntu, which I copied the config file from. Unfortunately, that OS has been destroyed)

I'm trying to turn off strict host key checking for a specific set of domains (in the example below, anything matching *.mydomain.com). /etc/ssh/ssh_config is completely commented out. I have a config file in ~/.ssh/config that equates to this:

Host                       *.mydomain.com
StrictHostKeyChecking      no
UserKnownHostsFile         /dev/null

Host                       foo
HostName                   myserver.mydomain.com
PasswordAuthentication     yes
User                       myuser

Now, when I execute ssh foo, I would expect that to alias to myuser@myserver.mydomain.com, realize that it should not perform StrictHostKeyChecking, ask me for a password and (when the correct password is entered), write a new Host Key entry to /dev/null (which, ofc, is essentially a NOP).

However, when I execute ssh foo presently on my system, it does alias and attempt to connect to the correct server with the correct user (meaning, it's reading my config file, otherwise it wouldn't know what 'foo' was), but gives me a Host Key Validation Error (which would otherwise be correct, as the Host Key is wrong in known_hosts). If I delete the offending key from known_hosts and try again, it writes the new Host Key into known_hosts instead of /dev/null. Essentially, it's like the first stanza in my config file is being ignored.

Is that an issue with my configuration, or is this a known issue or something? Any assistance would be appreciated.


SSH only searches the configuration file once to find options. So it takes the host name argument foo finds all matching sections, then merges them together.

It does not go back again through the config again looking for new configuration based on the final hostname/address that will be connected to.

So the 'issue' is simply that you are expecting ssh to work differently then how it works. Sorry about that. On occasion I have wished that it worked the way you are hoping also.

About all I can suggest is that you install the auto-completion functionality that is available for most shells. So instead of having an alias for foo you have an alias for foo.mydomain.com just type foo<tab> and it will auto-complete to myserver.mydomain.com.

  • I mean, this worked on my previous instance of Ubuntu 16.04 so...that's...odd. I really wish I still hadn't deleted that yet, but I mean, I have anecdotal evidence to the contrary – Cody S Nov 1 '17 at 21:23
  • Honestly I'm being a bit lazy, now that I think about it. It'd be easier (and more secure) to just add those two lines from the first stanza to whichever Host aliases I specifically want to turn that off for, instead of trying to find a wildcard. I'm working too hard. Thanks for your help – Cody S Nov 1 '17 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.