3

If I want to specify for LAN addresses that I don't want to deal with host keys, how do I do that?

/etc/ssh/ssh_config
Host 192.168.*.*
   StrictHostKeyChecking no
   UserKnownHostsFile /dev/null

or

UserKnownHostsFile none

even with

CheckHostIP no

Isn't doing the trick. openssh 7.1p1. With no known_hosts file in ~/.ssh or /etc, I still get:

The authenticity of host '<hostname> (192.168.2.2)' can't be established.
ECDSA key fingerprint is SHA256:.....
Are you sure you want to continue connecting (yes/no)?

This functionality was somewhat recently changed in openssh. Old questions suggest the ssh_config as shown above, which doesn't appear to work anymore.

Yes, this is a horrible idea. I want to do it anyway. It risks a man in the middle attack. It risks connecting to the wrong server if there's a configuration issue. I'm just tired of having to remove entries from known_hosts with the multiple VM's I have that often change fingerprints, and am willing to live with the risks. Yes, there's other questions like this, that explain how to do it the right way, but I don't want to do it that way. I just want to turn it off.

  • I don't always disable security, but when I do, I rsh. – thrig Aug 26 '15 at 23:01
  • i have a *.local hostname for my local hosts – Skaperen Aug 27 '15 at 8:51
4

Seems like your solution on openssh mailing list seems to be quite bearable. Reposting also here:

Match exec "ping -q -c 1 -t 1 %n | grep '192\.168\.'"
   StrictHostKeyChecking no
   UserKnownHostsFile /dev/null

Source: http://lists.mindrot.org/pipermail/openssh-unix-dev/2015-August/034335.html

  • 1
    Actually needs to be UserKnownHostsFile /dev/null, not none. I saw another post on the openssh mailing list which said "none" could be used. But this makes a file named none. – user1902689 Aug 28 '15 at 21:38
0

In ~/.ssh/config or /etc/ssh/ssh_config:

Host 192.168.*.*
  CheckHostIP no
  StrictHostKeyChecking no
  LogLevel=quiet
  UserKnownHostsFile=/dev/null

CheckHostIP no suppresses warnings about spoofing and stops the long pause when there's no host file.

StrictHostKeyChecking no removes a user prompt about connecting anyway if the authenticity of the remote machine is in question.

LogLevel=quiet removes the annoying message about adding the host to the list of known hosts.

UserKnownHostsFile=/dev/null stops the creation of a known_hosts file.

If you use hostnames for your local network, you'll need to add those too. Or if you're sure that you only use ssh on your local network, then simply use: Host *

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.