diff --git a/proxy/proxy/mgr-proxy-ssh-force-cmd b/proxy/proxy/mgr-proxy-ssh-force-cmd
index c763be5ccfb8..e92fb35d4418 100644
--- a/proxy/proxy/mgr-proxy-ssh-force-cmd
+++ b/proxy/proxy/mgr-proxy-ssh-force-cmd
@@ -3,6 +3,6 @@ set -- $SSH_ORIGINAL_COMMAND
 cmd="$1"
 shift
 case "$cmd" in
-  '/usr/bin/scp'|'/usr/bin/ssh'|'cat') exec "$cmd" "$@" ;;
-  *) echo "ERROR: command not allowed" ;;
-esac
\ No newline at end of file
+  '/usr/bin/scp'|'/usr/bin/ssh'|'cat'|'/usr/bin/ssh-keygen') exec "$cmd" "$@" ;;
+  *) echo "ERROR: command not allowed" >&2; exit 1 ;;
+esac
diff --git a/proxy/proxy/spacewalk-proxy.changes.mc.Manager-4.3-cleanup-proxy-known_hosts b/proxy/proxy/spacewalk-proxy.changes.mc.Manager-4.3-cleanup-proxy-known_hosts
new file mode 100644
index 000000000000..d4094b00beff
--- /dev/null
+++ b/proxy/proxy/spacewalk-proxy.changes.mc.Manager-4.3-cleanup-proxy-known_hosts
@@ -0,0 +1 @@
+- allow execute of ssh-keygen command on the proxy to cleanup ssh known_hosts (bsc#1228345)