How can I automate adding entries to .ssh/known_hosts?
Clash Royale CLAN TAG#URR8PPP
I administer a lot of hosts, and every time I ssh into a new batch for the first time, it is tedious to tell my secure shell client yes for each and every host that I accept the host key fingerprint for adding into ~/.ssh/known_hosts. If we accept as a given that I am confident that there are in fact no compromised host keys, is there any way to automate this? I do not want to disable key checking for subsequent connections.
For the sake of discussion, let's say that I have a list of all hosts in a text file, hostlist.txt.
ssh fingerprint
asked Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
add a comment |
I administer a lot of hosts, and every time I ssh into a new batch for the first time, it is tedious to tell my secure shell client yes for each and every host that I accept the host key fingerprint for adding into ~/.ssh/known_hosts. If we accept as a given that I am confident that there are in fact no compromised host keys, is there any way to automate this? I do not want to disable key checking for subsequent connections.
For the sake of discussion, let's say that I have a list of all hosts in a text file, hostlist.txt.
ssh fingerprint
asked Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
Also unix.stackexchange.com/a/110561/117549
– Jeff Schaller
Jan 29 at 23:15
I had a backup saving a TAR file to a backup server and I couldn't tell why the command was failing. Turns out the SCP call was waiting for me to acknowledge the fingerprint. Eventually it timed out. This was a cron job, so I didn't see any output.
– user208145
Jan 30 at 0:55
If the hosts are Internet hosts... and your DNS provider allows for sshfp records... you could simply put the host key fingerprints in DNS and then you don't need to worry about the host key checking, nor do you need to create an insecure TOFU situation....
– RubberStamp
Jan 30 at 1:01
1
Sorry.. "TOFU"?
– DopeGhoti
Jan 30 at 15:48
Trust On First Use?
– xenoid
Jan 30 at 16:04
add a comment |
I administer a lot of hosts, and every time I ssh into a new batch for the first time, it is tedious to tell my secure shell client yes for each and every host that I accept the host key fingerprint for adding into ~/.ssh/known_hosts. If we accept as a given that I am confident that there are in fact no compromised host keys, is there any way to automate this? I do not want to disable key checking for subsequent connections.
For the sake of discussion, let's say that I have a list of all hosts in a text file, hostlist.txt.
ssh fingerprint
asked Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
I administer a lot of hosts, and every time I ssh into a new batch for the first time, it is tedious to tell my secure shell client yes for each and every host that I accept the host key fingerprint for adding into ~/.ssh/known_hosts. If we accept as a given that I am confident that there are in fact no compromised host keys, is there any way to automate this? I do not want to disable key checking for subsequent connections.
For the sake of discussion, let's say that I have a list of all hosts in a text file, hostlist.txt.
ssh fingerprint
ssh fingerprint
asked Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
asked Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
asked Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
asked Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
asked Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
45.6k55988
Also unix.stackexchange.com/a/110561/117549
– Jeff Schaller
Jan 29 at 23:15
I had a backup saving a TAR file to a backup server and I couldn't tell why the command was failing. Turns out the SCP call was waiting for me to acknowledge the fingerprint. Eventually it timed out. This was a cron job, so I didn't see any output.
– user208145
Jan 30 at 0:55
If the hosts are Internet hosts... and your DNS provider allows for sshfp records... you could simply put the host key fingerprints in DNS and then you don't need to worry about the host key checking, nor do you need to create an insecure TOFU situation....
– RubberStamp
Jan 30 at 1:01
1
Sorry.. "TOFU"?
– DopeGhoti
Jan 30 at 15:48
Trust On First Use?
– xenoid
Jan 30 at 16:04
add a comment |
Also unix.stackexchange.com/a/110561/117549
– Jeff Schaller
Jan 29 at 23:15
I had a backup saving a TAR file to a backup server and I couldn't tell why the command was failing. Turns out the SCP call was waiting for me to acknowledge the fingerprint. Eventually it timed out. This was a cron job, so I didn't see any output.
– user208145
Jan 30 at 0:55
If the hosts are Internet hosts... and your DNS provider allows for sshfp records... you could simply put the host key fingerprints in DNS and then you don't need to worry about the host key checking, nor do you need to create an insecure TOFU situation....
– RubberStamp
Jan 30 at 1:01
1
Sorry.. "TOFU"?
– DopeGhoti
Jan 30 at 15:48
Trust On First Use?
– xenoid
Jan 30 at 16:04
Also unix.stackexchange.com/a/110561/117549
– Jeff Schaller
Jan 29 at 23:15
Also unix.stackexchange.com/a/110561/117549
– Jeff Schaller
Jan 29 at 23:15
I had a backup saving a TAR file to a backup server and I couldn't tell why the command was failing. Turns out the SCP call was waiting for me to acknowledge the fingerprint. Eventually it timed out. This was a cron job, so I didn't see any output.
– user208145
Jan 30 at 0:55
I had a backup saving a TAR file to a backup server and I couldn't tell why the command was failing. Turns out the SCP call was waiting for me to acknowledge the fingerprint. Eventually it timed out. This was a cron job, so I didn't see any output.
– user208145
Jan 30 at 0:55
If the hosts are Internet hosts... and your DNS provider allows for sshfp records... you could simply put the host key fingerprints in DNS and then you don't need to worry about the host key checking, nor do you need to create an insecure TOFU situation....
– RubberStamp
Jan 30 at 1:01
If the hosts are Internet hosts... and your DNS provider allows for sshfp records... you could simply put the host key fingerprints in DNS and then you don't need to worry about the host key checking, nor do you need to create an insecure TOFU situation....
– RubberStamp
Jan 30 at 1:01
1
1
Sorry.. "TOFU"?
– DopeGhoti
Jan 30 at 15:48
Sorry.. "TOFU"?
– DopeGhoti
Jan 30 at 15:48
Trust On First Use?
– xenoid
Jan 30 at 16:04
Trust On First Use?
– xenoid
Jan 30 at 16:04
add a comment |
2 Answers
2
active
oldest
votes
You can use the below option to not have to enter yes for each host with newer versions of ssh:
ssh -o 'StrictHostKeyChecking accept-new' host
edited Jan 31 at 15:34
DopeGhoti
45.6k55988
answered Jan 30 at 0:32
Praveen Kumar BSPraveen Kumar BS
1,478138
3
With new SSH,accept-newis better thanno(TOFU, but you are still notified if the server changes)
– Olorin
Jan 30 at 1:21
add a comment |
ssh-keyscan will check, but not verify, a remote host key fingerprint. Iterate through the host list and append to ~/.ssh/known_hosts:
while read host; do
if entry=$(ssh-keyscan $host 2> /dev/null); then
echo "$entry" >> ~/.ssh/known_hosts
fi
done < hostlist.txt
answered Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
1
You can just doif entry=$(...); then.
– Olorin
Jan 30 at 1:20
2
keyscan default is-t rsabut nowadays EC keys are common, and iteration is not needed, justssh-keyscan -t rsa,ecdsa,ed25519 $(cat hostlist.txt) >>~/.ssh/known_hosts(maybe also,dsadepending on your environment) or to avoid dupes... $(grep -Fvf <(cut -f1 -d' ' ~/.ssh/known_hosts | tr ',' 'n') hostlist.txt) ...
– dave_thompson_085
Jan 30 at 8:05
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f497568%2fhow-can-i-automate-adding-entries-to-ssh-known-hosts%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
You can use the below option to not have to enter yes for each host with newer versions of ssh:
ssh -o 'StrictHostKeyChecking accept-new' host
edited Jan 31 at 15:34
DopeGhoti
45.6k55988
answered Jan 30 at 0:32
Praveen Kumar BSPraveen Kumar BS
1,478138
3
With new SSH,accept-newis better thanno(TOFU, but you are still notified if the server changes)
– Olorin
Jan 30 at 1:21
add a comment |
You can use the below option to not have to enter yes for each host with newer versions of ssh:
ssh -o 'StrictHostKeyChecking accept-new' host
edited Jan 31 at 15:34
DopeGhoti
45.6k55988
answered Jan 30 at 0:32
Praveen Kumar BSPraveen Kumar BS
1,478138
3
With new SSH,accept-newis better thanno(TOFU, but you are still notified if the server changes)
– Olorin
Jan 30 at 1:21
add a comment |
You can use the below option to not have to enter yes for each host with newer versions of ssh:
ssh -o 'StrictHostKeyChecking accept-new' host
edited Jan 31 at 15:34
DopeGhoti
45.6k55988
answered Jan 30 at 0:32
Praveen Kumar BSPraveen Kumar BS
1,478138
You can use the below option to not have to enter yes for each host with newer versions of ssh:
ssh -o 'StrictHostKeyChecking accept-new' host
edited Jan 31 at 15:34
DopeGhoti
45.6k55988
answered Jan 30 at 0:32
Praveen Kumar BSPraveen Kumar BS
1,478138
edited Jan 31 at 15:34
DopeGhoti
45.6k55988
edited Jan 31 at 15:34
DopeGhoti
45.6k55988
edited Jan 31 at 15:34
DopeGhoti
45.6k55988
45.6k55988
answered Jan 30 at 0:32
Praveen Kumar BSPraveen Kumar BS
1,478138
answered Jan 30 at 0:32
Praveen Kumar BSPraveen Kumar BS
1,478138
answered Jan 30 at 0:32
Praveen Kumar BSPraveen Kumar BS
1,478138
1,478138
3
With new SSH,accept-newis better thanno(TOFU, but you are still notified if the server changes)
– Olorin
Jan 30 at 1:21
add a comment |
3
With new SSH,accept-newis better thanno(TOFU, but you are still notified if the server changes)
– Olorin
Jan 30 at 1:21
3
3
With new SSH,
accept-new is better than no (TOFU, but you are still notified if the server changes)– Olorin
Jan 30 at 1:21
With new SSH,
accept-new is better than no (TOFU, but you are still notified if the server changes)– Olorin
Jan 30 at 1:21
add a comment |
ssh-keyscan will check, but not verify, a remote host key fingerprint. Iterate through the host list and append to ~/.ssh/known_hosts:
while read host; do
if entry=$(ssh-keyscan $host 2> /dev/null); then
echo "$entry" >> ~/.ssh/known_hosts
fi
done < hostlist.txt
answered Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
1
You can just doif entry=$(...); then.
– Olorin
Jan 30 at 1:20
2
keyscan default is-t rsabut nowadays EC keys are common, and iteration is not needed, justssh-keyscan -t rsa,ecdsa,ed25519 $(cat hostlist.txt) >>~/.ssh/known_hosts(maybe also,dsadepending on your environment) or to avoid dupes... $(grep -Fvf <(cut -f1 -d' ' ~/.ssh/known_hosts | tr ',' 'n') hostlist.txt) ...
– dave_thompson_085
Jan 30 at 8:05
add a comment |
ssh-keyscan will check, but not verify, a remote host key fingerprint. Iterate through the host list and append to ~/.ssh/known_hosts:
while read host; do
if entry=$(ssh-keyscan $host 2> /dev/null); then
echo "$entry" >> ~/.ssh/known_hosts
fi
done < hostlist.txt
answered Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
1
You can just doif entry=$(...); then.
– Olorin
Jan 30 at 1:20
2
keyscan default is-t rsabut nowadays EC keys are common, and iteration is not needed, justssh-keyscan -t rsa,ecdsa,ed25519 $(cat hostlist.txt) >>~/.ssh/known_hosts(maybe also,dsadepending on your environment) or to avoid dupes... $(grep -Fvf <(cut -f1 -d' ' ~/.ssh/known_hosts | tr ',' 'n') hostlist.txt) ...
– dave_thompson_085
Jan 30 at 8:05
add a comment |
ssh-keyscan will check, but not verify, a remote host key fingerprint. Iterate through the host list and append to ~/.ssh/known_hosts:
while read host; do
if entry=$(ssh-keyscan $host 2> /dev/null); then
echo "$entry" >> ~/.ssh/known_hosts
fi
done < hostlist.txt
answered Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
ssh-keyscan will check, but not verify, a remote host key fingerprint. Iterate through the host list and append to ~/.ssh/known_hosts:
while read host; do
if entry=$(ssh-keyscan $host 2> /dev/null); then
echo "$entry" >> ~/.ssh/known_hosts
fi
done < hostlist.txt
answered Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
edited Jan 30 at 15:47
answered Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
answered Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
answered Jan 29 at 22:25
DopeGhotiDopeGhoti
45.6k55988
45.6k55988
1
You can just doif entry=$(...); then.
– Olorin
Jan 30 at 1:20
2
keyscan default is-t rsabut nowadays EC keys are common, and iteration is not needed, justssh-keyscan -t rsa,ecdsa,ed25519 $(cat hostlist.txt) >>~/.ssh/known_hosts(maybe also,dsadepending on your environment) or to avoid dupes... $(grep -Fvf <(cut -f1 -d' ' ~/.ssh/known_hosts | tr ',' 'n') hostlist.txt) ...
– dave_thompson_085
Jan 30 at 8:05
add a comment |
1
You can just doif entry=$(...); then.
– Olorin
Jan 30 at 1:20
2
keyscan default is-t rsabut nowadays EC keys are common, and iteration is not needed, justssh-keyscan -t rsa,ecdsa,ed25519 $(cat hostlist.txt) >>~/.ssh/known_hosts(maybe also,dsadepending on your environment) or to avoid dupes... $(grep -Fvf <(cut -f1 -d' ' ~/.ssh/known_hosts | tr ',' 'n') hostlist.txt) ...
– dave_thompson_085
Jan 30 at 8:05
1
1
You can just do
if entry=$(...); then.– Olorin
Jan 30 at 1:20
You can just do
if entry=$(...); then.– Olorin
Jan 30 at 1:20
2
2
keyscan default is
-t rsa but nowadays EC keys are common, and iteration is not needed, just ssh-keyscan -t rsa,ecdsa,ed25519 $(cat hostlist.txt) >>~/.ssh/known_hosts (maybe also ,dsa depending on your environment) or to avoid dupes ... $(grep -Fvf <(cut -f1 -d' ' ~/.ssh/known_hosts | tr ',' 'n') hostlist.txt) ...– dave_thompson_085
Jan 30 at 8:05
keyscan default is
-t rsa but nowadays EC keys are common, and iteration is not needed, just ssh-keyscan -t rsa,ecdsa,ed25519 $(cat hostlist.txt) >>~/.ssh/known_hosts (maybe also ,dsa depending on your environment) or to avoid dupes ... $(grep -Fvf <(cut -f1 -d' ' ~/.ssh/known_hosts | tr ',' 'n') hostlist.txt) ...– dave_thompson_085
Jan 30 at 8:05
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f497568%2fhow-can-i-automate-adding-entries-to-ssh-known-hosts%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Also unix.stackexchange.com/a/110561/117549
– Jeff Schaller
Jan 29 at 23:15
I had a backup saving a TAR file to a backup server and I couldn't tell why the command was failing. Turns out the SCP call was waiting for me to acknowledge the fingerprint. Eventually it timed out. This was a cron job, so I didn't see any output.
– user208145
Jan 30 at 0:55
If the hosts are Internet hosts... and your DNS provider allows for sshfp records... you could simply put the host key fingerprints in DNS and then you don't need to worry about the host key checking, nor do you need to create an insecure TOFU situation....
– RubberStamp
Jan 30 at 1:01
1
Sorry.. "TOFU"?
– DopeGhoti
Jan 30 at 15:48
Trust On First Use?
– xenoid
Jan 30 at 16:04