Why doesn't "yes yes | ssh hostname" work to automatically answer yes to host key authentication?

Question

When ssh hostname prompts with a

The authenticity of host 'foobar' can't be established.
ECDSA key fingerprint is ...
Are you sure you want to continue connecting (yes/no)?

I'm curious to know why the command:

yes yes | ssh hostname

doesn't work as a way of automatically answering yes to this question. The prompt still appears and waits for input on stdin. Shouldn't "yes" be sent from stdout of the yes program to the stdin of the ssh program? I'd like to understand a little deeper what's going on here and why this doesn't work.

For clarification, I am not interested in actually solving the problem of bypassing the prompt. I am purely interested in understanding why, fundamentally, this does not work. Probably I am completely misunderstanding how standard in works, and I'd like to understand what's actually going on.

Answer 1

There's a difference between standard input and interactive terminal keyboard input. That's also the reason you can't echo a password to the sudo prompt.

When you read things from the standard input, they're read from file descriptor 0, which is the usual data pipe, or keyboard input. In case of terminal input, you're really talking to your pseudoterminal device (pty/X). This is a nice split, because you can do things like cat some_file | ssh hostname and know it's sent as data. You don't have to care about the mechanism of authentication which can ask you many different questions on the way. The same thing applies to cat some_data | sudo command - you don't want the data to be treated as your password, since you don't even know if you'll be asked for it. You can also read things without them being echoed back to the user.

For pseudo terminal information in general, have a look at https://en.wikipedia.org/wiki/Pseudoterminal or https://unix.stackexchange.com/questions/21147/what-are-pseudo-terminals-pty-tty

If you want to interact with ssh in that way, you need to use (for example) expect. Alternatively, either append the signature to your known_hosts directly (ssh-keyscan will give you a proper line), or use ssh -o StrictHostKeyChecking=no,UserKnownHostsFile=/dev/null hostname.

From a security point of view those are terrible ideas though. If you want to get rid of the initial question, you can either publish the key in dns, or use host certificates.