12

I am trying to connect to a Linux host using ssh and get the following error

RSA host key for 10.1.1.20 has changed and you have requested strict checking.

I would like to override this, but can't seem to find any combination of options to do this.

I probably set StrictHostKeyChecking years ago, but don't remember how.

I consulted man ssh which informs me the system-wide configuration file is /etc/ssh/ssh_config and default for the per-user configuration file is ~/.ssh/config neither exists.

EDIT To clarify my question, the option is clearly set. I am trying to discover

  1. Where the options are stored (I don't have the files mentioned in the man page, which appears to be wrong).
  2. How to change the options.

I am not looking at how to work around the issue I am having (I know I can edit the known_hosts file, but this is tedious every time I try a new server).

  • It's /etc/ssh_config on mine. – sborsky Sep 5 '15 at 6:08
  • @sborsky I have this too (which is different from the man) but all options are commented out. – Milliways Sep 5 '15 at 6:21
  • This means default, which according to the man page is ask. When a host key changed, ssh client won't connect unless StrictHostKeyChecking is set to no. If the host key doesn't change very often, I'd suggest to remove this one host key from your ~/.ssh/known_hosts instead of changing the config. – sborsky Sep 5 '15 at 6:46
  • 1
    First you must figure out why it was changed. If you didn't change it, then it may be a MitM attack, and then you of course should not allow this host key! – Sarge Borsch Sep 5 '15 at 10:36
  • side note - after removing all records for a given host from .ssh/known_hosts I continued to get the warning until I discovered the offending row in another file called .ssh/known_hosts2. apparently OS X uses both – billynoah Aug 29 '18 at 0:53
17

To disable strict host checking on OS X for the current user, create or edit ~/.ssh/config and add the following lines:

Host [IP Address] 
   StrictHostKeyChecking no
   UserKnownHostsFile=/dev/null

A typical example for the hosts in your local network could be:

Host 10.1.1.*
   StrictHostKeyChecking no
   UserKnownHostsFile=/dev/null

Depending on your usage of ssh I don't recommend to disable strict host key checking for all hosts.

If you just want to remove the entry for 10.1.1.20 open ~/.ssh/known_hosts with an editor of your choice and remove the respective line "10.1.1.20 ssh-rsa public-key$"

  • Also seems to work without the /dev/null line. – John2095 Mar 17 '16 at 23:06
6

You can simply try it as it is without confitguration, just on commandline:

ssh -o StrictHostKeyChecking=no hostname

But I don't think it does all you need. If you want to ignore all hostkey checking, you need to set up you known_hosts file to /dev/null so there will never be anything stored:

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null hostname

or in /etc/ssh_config:

StrictHostKeyChecking no
UserKnownHostsFile /dev/null
  • The 1st still didn't allow me to connect, but ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null hostname did. I still can't find WHERE StrictHostKeyChecking is set! – Milliways Sep 10 '15 at 6:23
  • It defaults to "yes" so it doesn't have to be set anywhere to apply. – Jakuje Sep 10 '15 at 6:30
  • The documentation states it defaults to yes – Milliways Sep 10 '15 at 7:42
  • choosing as a solution would help if it helped to solve your problem ;) – Jakuje Sep 11 '15 at 19:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .