Bash: accepting a remote host fingerprint with ssh-keyscan

For security reasons, you should be very aware that accepting a remote host fingerprint automatically is a procedure that should be considered high-risk.

But if you are working with automated infrastructure or pipelines where human intervention is not possible and the constructed entities are being built in a secure fashion with guaranteed provenance, then ssh-keyscan can be used to retrieve and add the fingerprint to the known_hosts file.

ssh-keyscan -H $host >> ~/.ssh/known_hosts

Another option is to have ssh ignore the fingerprint check using the StrictHostKeyChecking option.

ssh -oStrictHostKeyChecking=no $host uptime

The StrictHostKeyChecking option can also be placed into ~/.ssh/config.

REFERENCES

ssh-keyscan man page

askubuntu.com, automatically accepting ssh key

askubuntu.com, strict host key checking

fixyacloud, adding ssh fingerprint only if new

digitalocean, setting up ssh login keys and syntax of command when ssh-copy-id is not available

NOTES

If use of ssh-copy-id is not possible

cat ~/.ssh/id_rsa.pub | ssh username@remote_host "mkdir -p ~/.ssh && touch ~/.ssh/authorized_keys && chmod -R go= ~/.ssh && cat >> ~/.ssh/authorized_keys"