diff --git a/sshpiperd/upstream/workingdir/config.go b/sshpiperd/upstream/workingdir/config.go
index bb217529..a19fc3e5 100644
--- a/sshpiperd/upstream/workingdir/config.go
+++ b/sshpiperd/upstream/workingdir/config.go
@@ -6,5 +6,6 @@ var (
 		AllowBadUsername bool   `long:"upstream-workingdir-allowbadusername" description:"Disable username check while search the working dir" env:"SSHPIPERD_UPSTREAM_WORKINGDIR_ALLOWBADUSERNAME" ini-name:"upstream-workingdir-allowbadusername"`
 		NoCheckPerm      bool   `long:"upstream-workingdir-nocheckperm" description:"Disable 0400 checking when using files in the working dir" env:"SSHPIPERD_UPSTREAM_WORKINGDIR_NOCHECKPERM" ini-name:"upstream-workingdir-nocheckperm"`
 		FallbackUsername string `long:"upstream-workingdir-fallbackusername" description:"Fallback to a user when user does not exists in directory" env:"SSHPIPERD_UPSTREAM_WORKINGDIR_FALLBACKUSERNAME" ini-name:"upstream-workingdir-fallbackusername"`
+		StrictHostKey    bool   `long:"upstream-workingdir-stricthostkey" description:"upstream host public key must in known_hosts file, otherwise drop the connection" env:"SSHPIPERD_UPSTREAM_WORKINGDIR_STRICTHOSTKEY" ini-name:"upstream-workingdir-stricthostkey"`
 	}{}
 )
diff --git a/sshpiperd/upstream/workingdir/workingdir.go b/sshpiperd/upstream/workingdir/workingdir.go
index b5da56b9..d2db5bca 100644
--- a/sshpiperd/upstream/workingdir/workingdir.go
+++ b/sshpiperd/upstream/workingdir/workingdir.go
@@ -10,6 +10,7 @@ import (
 	"bytes"
 	"fmt"
 	"github.com/tg123/sshpiper/sshpiperd/upstream"
+	"golang.org/x/crypto/ssh/knownhosts"
 	"io/ioutil"
 	"net"
 	"os"
@@ -26,6 +27,7 @@ var (
 	userAuthorizedKeysFile userFile = "authorized_keys"
 	userKeyFile            userFile = "id_rsa"
 	userUpstreamFile       userFile = "sshpiper_upstream"
+	userKnownHosts         userFile = "known_hosts"
 
 	usernameRule *regexp.Regexp
 )
@@ -144,6 +146,16 @@ func findUpstreamFromUserfile(conn ssh.ConnMetadata) (net.Conn, *ssh.AuthPipe, e
 		return nil, nil, err
 	}
 
+	hostKeyCallback := ssh.InsecureIgnoreHostKey()
+
+	if config.StrictHostKey {
+		hostKeyCallback, err = knownhosts.New(userKnownHosts.realPath(user))
+
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+
 	return c, &ssh.AuthPipe{
 		User: mappedUser,
 
@@ -158,7 +170,7 @@ func findUpstreamFromUserfile(conn ssh.ConnMetadata) (net.Conn, *ssh.AuthPipe, e
 			return ssh.AuthPipeTypeMap, ssh.PublicKeys(signer), nil
 		},
 
-		UpstreamHostKeyCallback: ssh.InsecureIgnoreHostKey(), // TODO should support by config
+		UpstreamHostKeyCallback: hostKeyCallback,
 	}, nil
 }