How to disable strict host key checking in ssh?

In your ~/.ssh/config (if this file doesn't exist, just create it):

Host *
    StrictHostKeyChecking no

This will turn it off for all hosts you connect to. You can replace the * with a hostname pattern if you only want it to apply to some hosts.

Make sure the permissions on the file restrict access to yourself only:

sudo chmod 400 ~/.ssh/config

Rather than adding it to your ~/.ssh/config file for all Host *, it would be a safer to specify a particular host.

You can also pass a parameter on the command-line like this:

ssh -o StrictHostKeyChecking=no yourHardenedHost.com

It's worth pointing out that setting in your ssh config:

StrictHostKeyChecking no

Will mean hostkeys are still added to .ssh/known_hosts - you just won't be prompted about whether you trust them, but should hosts change I'm willing to bet you'll get the big warning about it. You can work around this problem by adding another parameter:

UserKnownHostsFile /dev/null

This will add all these "newly discovered" hosts to the trash bin. If a host key changes, no troubles.

I would be remiss not to mention that circumventing these warnings on hostkeys has obvious security ramifications - you should be careful that you're doing it for the right reasons & that what you're connecting to actually is what you mean to connect to and not a malicious host, since at this point you've eroded a major part of the security in ssh as a solution.

For example if you were to try and set this with the commandline, the full command would be:

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null user@host

That would be silly though - given that the working examples above for ssh config files is likely to make more sense in all cases.

Tags:

Ssh