How to Use the Linux ssh-keyscan Command to Harvest Public Keys

When managing a massive fleet of Linux servers, administrators frequently automate remote tasks using Secure Shell (SSH). However, SSH is designed to prevent \”Man-in-the-Middle\” attacks. The very first time a script attempts to connect to a new server, SSH will mathematically halt the connection and present a prompt: \”Are you sure you want to continue connecting?\” If an automated script encounters this prompt, it will instantly hang and fail, waiting forever for a human to type \”yes.\” To prevent this bottleneck, engineers use the ssh-keyscan command to pre-harvest cryptographic signatures.

Why Use the ssh-keyscan Command?

When you type \”yes\” to that standard SSH prompt, you are instructing the client to mathematically accept the remote server’s public host key and append it to your local ~/.ssh/known_hosts file. The ssh-keyscan utility automates this entire process. It acts as a specialized network scanner that queries a remote server, mathematically extracts its public cryptographic host key (such as RSA or ED25519), and prints it in the exact format required by the known_hosts database, all without initiating an actual interactive login shell.

Step 1: Harvest a Key from a Single Server

Before you deploy an automated Ansible playbook or a bash script, you should prime your known_hosts file.

1. Open your Linux terminal.
2. Run the ssh-keyscan command, followed by the IP address or hostname of the target server:

ssh-keyscan 192.168.1.50

1. The terminal will output the server’s public cryptographic keys directly to standard output. It will typically grab multiple mathematical formats (e.g., ecdsa-sha2-nistp256, ssh-rsa, ssh-ed25519) simultaneously.

Step 2: Append the Output to known_hosts

Printing the keys to the screen does not actually fix the SSH warning prompt; you must mathematically inject the output into your local security database.

1. Use the >> redirection operator to silently append the harvested keys to the known_hosts file:

ssh-keyscan 192.168.1.50 >> ~/.ssh/known_hosts

Now, when your automated bash script connects to 192.168.1.50, the SSH client will immediately recognize the cryptographic signature in the database and bypass the confirmation prompt entirely.

Step 3: Scan Multiple Servers Simultaneously

If you have just spun up a cluster of 50 web servers, scanning them one by one is inefficient. The utility can accept a raw text file containing a list of IP addresses.

1. Create a file named servers.txt containing one IP address per line.
2. Use the -f (file) flag to feed the list into the scanner:

ssh-keyscan -f servers.txt >> ~/.ssh/known_hosts

The command will mathematically iterate through every IP address in the document, extract the host keys in parallel, and build a massive, pre-authenticated known_hosts database in seconds.

Step 4: Specify Key Types for Faster Scanning

To reduce network overhead and ignore deprecated cryptographic algorithms (like outdated RSA variants), you can restrict the scanner to only harvest modern elliptic curve keys.

1. Use the -t flag to specify the mathematical type:

ssh-keyscan -t ed25519 192.168.1.50

By integrating the ssh-keyscan command into their provisioning pipeline, Linux engineers can mathematically guarantee that headless automation scripts execute silently without encountering interactive security blocks.