The legacy behaviour of StrictHostKeyChecking=no involves allowing connections even if the host key has changed. What most deployments want when they set this is just TOFU. It is common for batch processing and cluster systems to deploy with this option permanently set, completely undermining the security of such systems - for example, an attacker could intercept a data processing stage to steal a copy of all of the private data.
From the man page: If this flag is set to “no”, ssh will automatically add new host keys to the user known hosts files. No mention of the HOST_CHANGED behaviour, so even somebody who mostly knows what they're doing is likely to get it wrong. Most people who use this option are better off with certificates now (or StrictHostKeyChecking=yes + ssh-keyscan).
Retarget pending bugs to openssh-7.1
Created attachment 2682 [details] Patch against ssh_config(5)
Retarget to openssh-7.3
Created attachment 2794 [details] add StrictHostkeyChecking=accept-new|off This adds a couple more granular options to StrictHostkeyChecking: "accept-new" (better name wanted) and "off". StrictHostkeyChecking=off is the current behaviour of "no". StrictHostkeyChecking=accept-new will accept new hostkeys without prompting but will disconnect for changed hostkeys. If this goes in then we can make StrictHostkeyChecking=no a synonym for accept-new at some future time (and with forewarning).
Instead of "accept-new", how about "StrictHostkeyChecking=known-only" or "known-hosts" or similar? That is more obvious about which host keys are strict (and "known-hosts" implies the file of a similar name where such keys are stored...).
retarget unfinished bugs to next release
OpenSSH 7.4 release is closing; punt the bugs to 7.5
Move incomplete bugs to openssh-7.6 target since 7.5 shipped a while back. To calibrate expectations, there's little chance all of these are going to make 7.6.
remove 7.5 target
Created attachment 3049 [details] updated to -current
Patch is applied; will be in openssh-7.6
Move to OpenSSH 7.8 tracking bug
Created attachment 3159 [details] flip meaning of StrictHostKeyChecking=no The only thing remaining in this bug is to change the meaning of StrictHostKeyChecking=no from accepting changed host keys (with restrictions) to refusing them. We'll wait a few more releases before committing this.
Remove release target for now