Set UpdateHostKeys for interactive invocations of ssh client to 'ask' by default. ( Related this request, I notice that Fabric, http://docs.fabfile.org/en/1.14/usage/ssh.html, defaults to loading and using the known_hosts file **but** reject_unknown_hosts defaults to false (so hosts that have never "been seen" are allowed) this combined with Fabric seemingly preferring an rsa host key while I had an ecdsa host key for $host would have allowed MITM attacks. )
I ran into this recently when trying to work out how we might do host key rotation on a large SSH server. This is a code hosting site to which you can push code over SSH, usable by anyone who's given us a public key rather than limited to a single organisation, so we can't mandate any particular client setup and the host key certificate mechanisms don't really work all that well for us either. Life would be a lot easier in this kind of environment if UpdateHostKeys were on in some way by default. (We'd actually probably need it to have been on by default for a few years, and something similar to be in some other popular clients too, but you have to start somewhere.)
(Sorry, I submitted the last comment by accident before I'd finished writing it ...) Is there an explanation somewhere for why UpdateHostKeys is off? The best I could find was a git commit from 2015 saying "turn UpdateHostkeys off by default until I figure out mlarkin@'s warning message". And I wonder if https://bugzilla.mindrot.org/show_bug.cgi?id=2631 would also need to be fixed in order to use this in practice?
IIRC there might be some corner cases wrt multiple keys files. It was a bit fiddly IIRC
Committed; will be in openssh-8.2
I've had to revert this change. It doesn't play well with certificate host keys and I'm unsure of the interaction with @revoked lines in known_hosts. Both these need to be fixed before it gets enabled again. I plan to do this early in the 8.3 release cycle to give it as long as possible to bake.
Prepare for 8.2 release; retarget bugs
Retarget bugs to 8.4 release
retarget to 8.6
AFAIK this was addressed in OpenSSH 8.5p1 https://www.openssh.com/txt/release-8.5
retarget after 8.6p1 release
The last release enabled UpdateHostkeys by default under most circumstances
closing bugs resolved before openssh-8.9