I have server script that automatically pulls down and installs a github repository. As part of the script, I'm running ssh-keyscan -H github.com >> ~/.ssh/known_hosts as the git user to automatically accept github's RSA key prior to checking out the repo.

I have successfully used this same script in a local vagrant instance, as well as on several servers. However, on one of the servers this doesn't work, because ssh-keyscan -H github.com doesn't return any output (I've tried this as the git user, my personal user, and as root, and the command acts the same). I can ping github.com, so it's not a connection issue; I can also run ssh-keyscan successfully on another server in the same network. I've tried upgrading SSH to see if that might be the issue, but it is already on the latest version for my distribution (CentOS 7).

Where would be a good place to start in troubleshooting this? I've tried searching StackExchange for issues related to 'ssh-keyscan', but I haven't yet found anything that fits this particular problem.

  • Update: I have also removed and reinstalled (and restarted) SSH. The problem remains. Perhaps this implies a config issue, but I don't see anything unusual in the config files.
    – Jay
    Feb 20 '17 at 19:11
  • 1
    I know this is a bit off topic but in situations where you control the remote server you might want to check whether SSH is listening on IPv6 connections on that server. ssh-keyscan prefers IPv6 over IPv4 by default if it's available. And it could be the reason it can't connect. Nov 30 '18 at 8:03
  • To clarify: ssh-keyscan localhost gave this error: "write(localhost): Connection refused", but ssh-keyscan -4 localhost worked.
    – Yeti
    Jun 22 '20 at 7:37

This does sound like a network problem to me.

The first thing that I would do is try telnetting to various SSH servers on port 22, something like the following:

$ telnet local-git-server 22

followed by:

$ telnet github.com 22

When you run this, you should see similar output to the following:

Escape character is '^]'. SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2

This is a good indication that ssh is permitted without any firewall restrictions.

  • What was the end result from ssh-keyscan?
  • What did it print, if anything?
  • Does the telnet hang for several seconds? Do you get a connection refused or connection rejected response?
  • If you run netstat -an --tcp do you see several TCP entries that are in SYN_SENT state? If so, this would indicate there is something blocking at the network layer
  • Running telnet github.com 22 results in a 'Connection refused' message, which doesn't happen on the other servers. Running netstat -an --tcp does not reveal any SYN_STATE entries. As for the output of ssh-keyscan, there is absolutely no output -- no error messages, no warning messages, nothing.
    – Jay
    Feb 20 '17 at 21:54
  • If you're getting connection refused then you need to look into the network layer. Could your machine or LAN firewall be blocking? Could github.com be refusing?
    – Ed Neville
    Feb 20 '17 at 21:57
  • I don't think github.com is refusing, but thanks for your point in the right direction. Instead of looking on the machine itself, I suspect I now need to contact the network team to find out what's going on from their end. Thanks!
    – Jay
    Feb 20 '17 at 22:06

I had the same issue (no output being given) and it was because the default timeout (5 seconds) was too short. I resolved this by using the -T flag which allows me to set my own custom timeout (in seconds). Illustrative example with 240 second timeout and random IP address:

ssh-keyscan -T 240
  • This -- thank you. Feels like a bug that there's no error message on this.
    – Codebling
    Jan 13 at 22:40

Try running ssh-keyscan -p <PORT> <IP> if your ssh server is not running on default port


I had a similar problem when I ran ssh-keyscan github.com. I tried putting a custom -T flag to increase the timeout but there was no output whatsoever. So to debug the problem I ran ssh -vvv github.com to connect to github.com on port 22. The -vvv gave some debug information and ultimately the command ran to Operation timed out. So there might be a few solutions to this. You can ask your ISP provider if port 22 is enabled, or like in my case it was caused by a third party software (Teamviewer). Uninstalling it resolved the problem. This is a solution that helped me but in your case there might be something else involved.


I had the same issue, i was able to ping the but

ssh-keyscan server IP 

gave this error:

write(localhost): Connection refused

The issue in my case was ssh port in that server was open on a different port (7999 in my case) rather than the default 22 as ssh port. Explicitly adding the port number solved the issue. Here is the command that worked for me:

ssh-keyscan -p 7999  -T 100 -t rsa -4 server IP >> ~/.ssh/known_hosts

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.