I'm attempting to build a global known_hosts file for my AWS VPC, and was looking at using ssh-keyscan to acquire the fingerprints of new servers as they are created. The -H option seems sensible, as it means you

do not reveal identifying information should the file's contents be disclosed

Strangely though, the output of that command comes with a helpful header:

# SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.4

... which seems to rather defeat the point doesn't it? Obviously I can strip that bit out very easily, but having asked for hashing, I'd expect the output to contain only hashed data. Is there some logical reason for this, or is it a bug?

  • For reference, to ignore the comment: ssh-keyscan -H -t ecdsa | grep ^[^#]
    – IBam
    Mar 4, 2016 at 9:48

1 Answer 1


Is there some logical reason for this, or is it a bug?

It's not a bug, it is a feature. The line with the comment is written to stderr unlike the host keys, therefore it is no problem if you do

ssh-keyscan -H -t rsa host > /your/known_hosts

The list of hosts will go to your terminal and not into the file.


ssh-keyscan -H -t rsa host 2> /dev/null

will show you only the hashed keys and no "comments" with hostnames.

  • It's rather odd and annoying that it does this, but piping stderr to /dev/nullis how I clean its output too.
    – starfry
    Dec 23, 2016 at 15:13
  • @starfry It is quite standard way, writing output to stdout and notes/errors to stderr. Isn't it what I wrote in my answer?
    – Jakuje
    Dec 23, 2016 at 15:18
  • I was just agreeing with you. I encountered your answer when searching for any other way to suppress the unwanted output in the first place (like a -q option) but there isn't one.
    – starfry
    Dec 23, 2016 at 15:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .