When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has multiple IPs.

What I don't understand is why SSH needs to record the hostname in known_hosts. When I use my private key to authenticate myself to GitHub, there is no need for me to present an IP/domain name to GitHub. Why cant' SSH authenticate the server as original with only its key?

  • It's a key value pair. There can be many. Sep 21, 2014 at 14:38

4 Answers 4


Consider the following hypothetical:

  • You have known_hosts entries for both nsa.gov and github.com.
  • Now evil.net both infiltrates github.com and also obtains MITM-level control over your internet connection/DNS.
  • Now you SSH into nsa.gov, and evil.net presents you with stolen github.com credentials
  • Your SSH client cycles through your known_hosts until it finds one that matches and accepts the connection.
  • Now you are connected to evil.net thinking it is nsa.gov because of a breach at a 3rd party.

Perhaps this is a risk you are willing to take, but it is not one the designers of SSH were.

My own known_hosts file specifies github.com by name, in addition to by IP address. I've never had the problem you describe, unless I intentionally change the file to cause the problem.


I think the other answers here are correct answers to a simpler version of the OP's question, but miss a certain subtlety in the question. SSH is frequently described as implementing public key cryptography schemes as its authentication method, but the OP has noticed that this is not strictly so. Rather, there is an additional layer of security in the SSH suite which depends on the hostname resolution system.

Although it was probably a good design choice for SSH, it has a couple of small unfortunate side effects. Namely:

  1. It might appear to the casual user that the additional layer of security somehow uses public key cryptography to authenticate the domain name association (i.e. the integrity of the DNS system in the given case) in addition to the client itself. These users will have a false sense of security.

  2. It might appear to the smart but uninitiated user (e.g. possibly the OP) that the public key crytography scheme is being bypassed when the user agrees to continue connecting to a host whose authenticity apparently "could not be established". These users will have a false sense of insecurity.

What is being bypassed in (2) is only the additional layer of security, on top of the public key cryptography scheme, related to hostname resolution.


The whole point in having a known_hosts is to keep a record of keys associated with the host they belong to. To be more specifically, it records the key associated with the hostname you tried to connect to with the ssh, scp or sftp command. It will help you avoid MITM attacks, since any SSH-based command will alert you if the server key has changed since it recorded it in your known_hosts.

As long as you use the same hostname and it presents the same key, it does not matter if it has multiple IP or not.

  • This does not answer my question at all. I am specifically asking why a hostname is needed. Only the right host knows the private key, right? Why do I care about the hostname, as long as the key matches?
    – Siyuan Ren
    Sep 21, 2014 at 13:07
  • SSH allows you to connect to any site. How would SSH know whose key should be matching then? If not storing which key corresponds to which host, every time you had a mismatch with your known hosts, how would you know it is because it is a new site, a MITM attack or your file got corrupted?
    – NuTTyX
    Sep 21, 2014 at 13:10
  • It can simply match the key presented by the server against a known keys of hosts, just like how the server authenticate the client by searching the authorized_keys file.
    – Siyuan Ren
    Sep 21, 2014 at 13:13
  • 1
    When you present a private key as an authentication method, you are presenting a username which it belongs to. In any case, in SSH there is no "issuer" neither a "hostname" as in certificates. You must trust it and keep a record of it in case it changes. My known_hosts has over 200 entries. How would I know if any of the servers I'm connecting to has been exposed, they've changed their keys, it is a new server, or my file got corrupted if I do not keep a list of which sites I'm connecting to? And what if any of those servers got the key of another one?
    – NuTTyX
    Sep 21, 2014 at 13:19

The other answers deal with your question, more or less to my satisfaction. I'm going to address your circumstances:

When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has multiple IPs.

You were using a version of SSH where CheckHostIP was enabled.

For servers that use multiple IPs, it's reasonable to turn it off. As someone mused on ServerFault, CheckHostIP is not really that helpful. In fact, the OpenSSH maintainer decided to disable it by default.

I think we're more likely to turn off CheckHostIP (the thing that spams addresses into known_hosts) in the short term, as nobody has satisfactorily explained what problem it solves to me.

@DamienMiller (Twitter, 2020-12-11)

So either disable CheckHostIP in your ~/.ssh/config, or update to OpenSSH v8.5 or later.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .