title: What is the secure/correct way of adding www.github.com to the known_hosts file?
body: <p>I want to access my github repositories via ssh. When I access the repository for the first time, I am asked If I want to add the github ssh server to my <code>known_hosts</code> file, which works fine. That request also shows me the RSA key fingerprint of that server and I can manually verify that it is the same that is provided by github <a href="https://help.github.com/articles/github-s-ssh-key-fingerprints/" rel="noreferrer">here</a>.</p>
  
  <blockquote>
    <p>These are the SHA256 hashes shown in OpenSSH 6.8 and newer (in base64 format):</p>
  </blockquote>
  
  <pre><code>SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8 (RSA)
  SHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ (DSA)
  </code></pre>
  
  <p>The problem is that I want to prevent that request by adding a public key
  to my <code>known_hosts</code> file before my first access to my git repository. This can be done by using the <code>ssh-keyscan -t rsa www.github.com</code> command which will give me a public key in the format required by the <code>known_hosts</code> file. But people mention repeatedly, that this is not safe and is vulnerable to man-in-the-middle attacks. What they do not mention is how to do it right.</p>
  
  <p>So how can I use the RSA fingerprint provided on the github page to safely get the public host key of the ssh server? I am more or less looking for an option to the <code>ssh-keyscan</code> command that lets me add the expected rsa fingerprint and causes the command to fail if the hosts fingerprint does not match the given one.</p>
  
  <p>Thank you for your time!</p>