How can I force ssh to accept a new host fingerprint from the command line?

Question

I'm getting the standard ``` WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed. The fingerprint for the RSA key sent by the remote host is ``` error message. However, the system (Appworx) that executes the command (sftp I think, not that it matters) is automated and I can't easily accept the new key, even after checking with the third party vendor that it is a valid change. I can add a new shell script that I can execute from the same system (and user), but there doesn't seem to be a command or command-line argument that will tell ssh to accept the key. I can't find anything in the man page or on Google. Surely this is possible?

Accepted Answer

Here's how to tell your client to trust the key. A better approach is to give it the key in advance, which I've described in the second paragraph. This is for an OpenSSH client on Unix, so I hope it's relevant to your situation.

You can set the `StrictHostKeyChecking` parameter. It has options `yes`, `no`, and `ask`. The default is `ask`. To set it system wide, edit `/etc/ssh/ssh_config`; to set it just for you, edit `~/.ssh/config`; and to set it for a single command, give the option on the command line, e.g.

```
ssh -o "StrictHostKeyChecking no" hostname
```

An alternative approach if you have access to the host keys for the remote system is to add them to your `known_hosts` file in advance, so that SSH knows about them and won't ask the question. If this is possible, it's better from a security point of view. After all, the warning might be right and you really might be subject to a man-in-the-middle attack.

For instance, here's a script that will retrieve the key and add it to your known_hosts file:

```
ssh -o 'StrictHostKeyChecking no' hostname cat /etc/ssh/ssh_host_dsa_key.pub >>~/.ssh/known_hosts
```

How can I force ssh to accept a new host fingerprint from the command line?

Solution

Problem