Take the 2-minute tour ×

I get the following prompt everytime I try to connect a server using SSH. I type "yes", but is there a way to aovid this?

The authenticity of host '111.222.333.444 (111.222.333.444)' can't be established.
RSA key fingerprint is f3:cf:58:ae:71:0b:c8:04:6f:34:a3:b2:e4:1e:0c:8b.
share|improve this question
/dev/null exists for those who think they are immune to man in the middle attacks :) –  Tim Post Mar 29 '10 at 10:08
usefull with scripts targeting dyndns domains –  Mathieu Oct 14 '12 at 19:34
add comment

migrated from stackoverflow.com Mar 29 '10 at 12:38

This question came from our site for professional and enthusiast programmers.

4 Answers

up vote 45 down vote accepted

Use the -o option,

ssh -o "StrictHostKeyChecking no" user@host
share|improve this answer
You may want to use an alternate identity file with the flag '-i' –  MUY Belgium Apr 22 '13 at 10:08
add comment

You should only get this the first time you connect to a new host. After you respond yes the host gets stored in ~/.ssh/known_hosts and you won't get prompted the next time you connect.

Note that if ~/.ssh/known_hosts can not be written for any reason (e.g. permissions problem) then you will get prompted every time you connect.

share|improve this answer
+1, quite precise and correct answer. –  Jack Mar 29 '10 at 9:52
The question is is there anyway to avoid the prompt? –  shantanuo Mar 29 '10 at 10:44
I tried adding "CheckHostIP no" to /etc/ssh/ssh_config file. But it does not seem to be working –  shantanuo Mar 29 '10 at 10:46
add comment

Add the following lines to the beginning of /etc/ssh/ssh_config...

Host 192.168.0.*
   StrictHostKeyChecking no


  • The Host subnet can be * to allow unrestricted access to all IPs.
  • Edit /etc/ssh/ssh_config for global configuration or ~/.ssh/config for user-specific configuration.


share|improve this answer
add comment

The best way (because it does not sacrifice security) is to connect once to all computers from one client (you'll be prompted every time, always answer yes). As pointed out in the other answer, the keys will then be stored in ~/.ssh/known_hosts. Then copy this file to every client computer you might later want to connect from (possibly for each user account you use). Then all these accounts will "know" the computers, hence no prompt.

The advantage over just disabling the prompt is that SSH can actually check if there is a MITM attack.

share|improve this answer
add comment

Your Answer


