How to Disable strict SSH host key checking via WHM?

What is Strict SSH Host Key Checking?

SSH host key checking is a security mechanism that verifies the identity of a remote server before establishing an SSH connection. When strict host key checking is enabled (the default and recommended setting), WHM will refuse to connect to a remote server if its host key has changed since the last known connection — this protects against man-in-the-middle attacks.

In certain situations, such as server migrations, re-provisioning, or automated backup scripts, the host key may legitimately change. Disabling strict host key checking allows WHM to connect to remote servers without verifying their identity each time.

Steps to Disable Strict SSH Host Key Checking

1. Log in to WHM as the root user.
2. Navigate to Home » Server Configuration » Tweak Settings.
3. In the search box at the top, type SSH host key to locate the option quickly.
4. Under the Security tab, find Disable strict SSH host key checking.
5. Set the toggle to On to disable strict host key checking.
6. Click Save at the bottom of the page.

Important Notes

• Security warning: Disabling this setting reduces the security of SSH connections from your server. It makes your server vulnerable to man-in-the-middle attacks when connecting to remote servers. Only disable this if you understand and accept the risk.
• This setting affects WHM features that connect to remote servers over SSH, such as Transfer Tool, Remote MySQL, and backup operations.
• If you disable this temporarily for a migration, remember to re-enable it afterward by setting the toggle back to Off.
• An alternative to disabling this globally is to manually update the known_hosts file for the specific remote server. This preserves security while handling the key change for one server.

Troubleshooting

• Connection refused after re-provisioning: If a remote server was rebuilt and its SSH key changed, you may see "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED" errors. Either disable strict checking temporarily, or remove the old key with the command ssh-keygen -R hostname from the root SSH terminal.
• Can't find the option: Use the Tweak Settings search bar and type SSH host key. The setting is under the Security tab.

For official documentation, see the cPanel Tweak Settings guide.