diff --git a/lftp-4.6.1-auto-confirm.patch b/lftp-4.6.1-auto-confirm.patch
new file mode 100644
index 0000000..5fa9b04
--- /dev/null
+++ b/lftp-4.6.1-auto-confirm.patch
@@ -0,0 +1,59 @@
+diff -up lftp-4.5.4/doc/lftp.1.auto-confirm lftp-4.5.4/doc/lftp.1
+--- lftp-4.5.4/doc/lftp.1.auto-confirm	2014-07-10 09:57:29.000000000 +0200
++++ lftp-4.5.4/doc/lftp.1	2015-02-26 13:54:34.339241828 +0100
+@@ -1308,6 +1308,10 @@ address family in dns:order.
+ .BR file:charset \ (string)
+ local character set. It is set from current locale initially.
+ .TP
++.BR fish:auto-confirm \ (boolean)
++when true, lftp answers ``yes'' to all ssh questions, in particular to the
++question about a new host key. Otherwise it answers ``no''.
++.TP
+ .BR fish:charset \ (string)
+ the character set used by fish server in requests, replies and file listings.
+ Default is empty which means the same as local.
+@@ -1868,6 +1872,10 @@ minimal chunk size to split the file to.
+ save pget transfer status this often. Set to `never' to disable saving of the status file.
+ The status is saved to a file with suffix \fI.lftp-pget-status\fP.
+ .TP
++.BR sftp:auto-confirm \ (boolean)
++when true, lftp answers ``yes'' to all ssh questions, in particular to the
++question about a new host key. Otherwise it answers ``no''.
++.TP
+ .BR sftp:charset \ (string)
+ the character set used by SFTP server in file names and file listings.
+ Default is empty which means the same as local. This setting is only used
+diff -up lftp-4.5.4/src/resource.cc.auto-confirm lftp-4.5.4/src/resource.cc
+--- lftp-4.5.4/src/resource.cc.auto-confirm	2014-07-10 10:03:35.000000000 +0200
++++ lftp-4.5.4/src/resource.cc	2015-02-26 14:28:10.878541470 +0100
+@@ -337,6 +337,7 @@ static ResType lftp_vars[] = {
+    {"mirror:skip-noaccess",	 "no",    ResMgr::BoolValidate,ResMgr::NoClosure},
+    {"mirror:no-empty-dirs",	 "no",	  ResMgr::BoolValidate,ResMgr::NoClosure},
+ 
++   {"sftp:auto-confirm",	 "no",	  ResMgr::BoolValidate,0},
+    {"sftp:max-packets-in-flight","16",	  ResMgr::UNumberValidate,0},
+    {"sftp:protocol-version",	 "6",	  ResMgr::UNumberValidate,0},
+    {"sftp:size-read",		 "32k",	  ResMgr::UNumberValidate,0},
+@@ -365,6 +366,7 @@ static ResType lftp_vars[] = {
+    {"dns:strict-dnssec",	 "no",	  ResMgr::BoolValidate,0},
+ #endif
+ 
++   {"fish:auto-confirm",	 "no",	  ResMgr::BoolValidate,0},
+    {"fish:shell",		 "/bin/sh",0,0},
+    {"fish:connect-program",	 "ssh -a -x",0,0},
+    {"fish:charset",		 "",	  ResMgr::CharsetValidate,0},
+diff -up lftp-4.5.4/src/SSH_Access.cc.auto-confirm lftp-4.5.4/src/SSH_Access.cc
+--- lftp-4.5.4/src/SSH_Access.cc.auto-confirm	2014-05-06 15:16:14.000000000 +0200
++++ lftp-4.5.4/src/SSH_Access.cc	2015-02-26 13:54:34.340241830 +0100
+@@ -72,8 +72,9 @@ int SSH_Access::HandleSSHMessage()
+       }
+       if(s>=y_len && !strncasecmp(b+s-y_len,y,y_len))
+       {
+-	 pty_recv_buf->Put("yes\n");
+-	 pty_send_buf->Put("yes\n");
++	 const char *answer=QueryBool("auto-confirm",hostname)?"yes\n":"no\n";
++	 pty_recv_buf->Put(answer);
++	 pty_send_buf->Put(answer);
+ 	 return m;
+       }
+       if(!received_greeting && recv_buf->Size()>0)
diff --git a/lftp.spec b/lftp.spec
index 5cca0ef..f0878ac 100644
--- a/lftp.spec
+++ b/lftp.spec
@@ -1,7 +1,7 @@
 Summary:	A sophisticated file transfer program
 Name:		lftp
 Version:	4.5.4
-Release:	2%{?dist}
+Release:	3%{?dist}
 License:	GPLv3+
 Group:		Applications/Internet
 Source0:	ftp://ftp.yar.ru/pub/source/%{name}/%{name}-%{version}.tar.xz
@@ -10,6 +10,7 @@ BuildRoot:	%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires:	ncurses-devel, gnutls-devel, pkgconfig, readline-devel, gettext
 
 Patch1:  lftp-4.0.9-date_fmt.patch
+Patch2:  lftp-4.6.1-auto-confirm.patch
 
 %description
 LFTP is a sophisticated ftp/http file transfer program. Like bash, it has job
@@ -30,6 +31,7 @@ Utility scripts for use with lftp.
 %setup -q
 
 %patch1 -p1 -b .date_fmt
+%patch2 -p1 -b .auto-confirm
 
 #sed -i.rpath -e '/lftp_cv_openssl/s|-R.*lib||' configure
 sed -i.norpath -e \
@@ -92,6 +94,9 @@ rm -rf $RPM_BUILD_ROOT
 
 
 %changelog
+* Thu Feb 26 2015 Tomas Hozza <thozza@redhat.com> - 4.5.4-3
+- Don't auto accept remote host SSH fingerprint (new option auto-confirm) (#1180209)
+
 * Wed Aug 13 2014 Jiri Skala <jskala@redhat.com> - 4.5.4-2
 - BZ#1129504: corrected path to tarball in spec file