ssh remote host identification has changed [closed]

Question

I've reinstalled my server and I am getting these messages:

[user@hostname ~]$ ssh root@pong
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
6e:45:f9:a8:af:38:3d:a1:a5:c7:76:1d:02:f8:77:00.
Please contact your system administrator.
Add correct host key in /home/hostname /.ssh/known_hosts to get rid of this message.
Offending RSA key in /var/lib/sss/pubconf/known_hosts:4
RSA host key for pong has changed and you have requested strict checking.
Host key verification failed.

I have tried various solutions that I found on the Internet. My known_hosts file (normally in ~/.ssh/known_hosts) is in /var/lib/sss/pubconf/known_hosts. I've tried to edit it, but it remains in one state. I have installed ipa-client and have Fedora 19. How do I resolve this warning?

All the answers answered so far work only if you do not have Freeipa installed.

The right answer for freeipa in comments below from adrin is here.

Chen

just found out hard way that this problem can also happen if you have ip address conflict nslookup your ip to debug this issue more – Mcdaniels

There is a deadlock here. This one is marked duplicate so no one can add answer and the one it links is marked off topic so no can add answer there as well. If you delete the known_hosts, it will fix the issue as well. – Shawnee

I had the same problem. For the sake of mine and others, here's the question and my answer to it: superuser.com/questions/1071204/… – Karlenekarlens

As someone looking to verify their key first I found this answer useful. askubuntu.com/a/83499/620623 – Garrot

As sharrajesh mentions: check your DNS entries (in FreeIPA for me) and see you don't have multiple A entries with IPs that are not reachable from the network. – Forwent

This situation happens while your server's certified key is different from the keys you have saved. Firstly,you should check if server's fingerprint (eg:SHA256:6e:45:f9:a8:af:38:3d:a1:a5:c7:76:1d:02:f8:77:00) is same as your target machine's fingerprint. If not, you are being man-in-the-middle attack Don't just remove keys from know_hosts!!!!!!!!!! – Rarotonga

ssh-keygen -f "/root/.ssh/known_hosts" -R 192.162.1.1 or ssh-keygen -R 192.162.1.1 – Subvention

Filip, would you consider marking one of the answers provided as accepted one? :) – Incarnation

@Muhamed unfortunately any of the answers answered so far would not work for me as the sssd would refetch the original key from the free IPA again. The only working answer came from adrin in form of comment with link to superuser.com. (the link is now included in my question at the very end. – Risarise

You may have used this same ip address on another client. A quick fix is to just change your clients address to a new address and try again. – Gwyn

See also: digitalocean.com/community/questions/… – Chiller

It seems that GitHub updated its RSA SSH host key for security reasons. If anyone is experiencing the same issue try to run ssh-keygen -R github.com command. – Riffe

If you're ending up on this question in March 2023, it's likely because GitHub just updated their RSA key. Details on what to do here: github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key – Comnenus

LATEST UPDATE : github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key – Lachus

One command to solve it: ssh-keygen -R github.com – Wellknit

To resolve this issue, you can open the known_hosts file using the Nano text editor with the command nano ~/.ssh/known_hosts, then search for all instances of github.com and remove them. Once you've removed the outdated fingerprints, save the file and try to connect to GitHub again. The next time you attempt to connect, you should be prompted to add new fingerprints to your known_hosts file. Confirm that you want to add the new fingerprints by typing "yes" and pressing enter, and you should be good to go! – Tasset

Thank you @Leonardo. Question is closed so nobody can come back to add updated answers... – Corroborate

Thank you @YuvrajsinhJhala. With your helpful note, after removing all the entries using ssh-keygen -R github.com, I restarted my SourceTree app, and "pushing" is working now (I didn't add any new lines manually or use a bash command). Also, I updated the SourceTree app before pushing for the first time. – Accede

Started getting this for bitbucket too... ssh-keygen -R bitbucket.org fixed it – Lapoint

I have the same issue with bitbucket today! – Aiglet

I faced above issue while connecting to github from ssh. solution: ssh-keygen -R github.com , (For Reference and explanation: builtin.com/software-engineering-perspectives/…) – Janaye

If you are running this command in the window inside CMD then please remove the known_hosts under the .ssh folder – Hebdomad

Answer 1

Here is the simplest solution:

ssh-keygen -R <host>

For example,

ssh-keygen -R 192.168.3.10

From the ssh-keygen man page:

-R hostname Removes all keys belonging to hostname from a known_hosts file. This option is useful to delete hashed hosts (see the -H option above).

PS: For windows, execute this command in git bash

Edge

I am on Windows and this solution, nor does removing key, work, what else can I try? – Lithic

Alright, turns out on Windows I need to use terminal from git bash for this (or any MingW32 terminal). Tricky. – Lithic

keep in mind that if you connected via a specific port, you might have to remove with syntax like ssh-keygen -R [127.0.0.1]:3022. Just check your .ssh/known_hosts file for what it explicitly says. – Ardis

@KashifNazar But I'm removing known host file and re-adding while connection establishes. It is working, although after few time it is again getting changed to something else resulting in the same issue. Any help ! – Intimate

⁺¹ of course, but is there a way to not do it? E.g. I'm often rewriting a system of embedded device, to which I need to connect to, and it's quite annoying to rerun the command every time. – Azucenaazure

When I try this I get the error "<hostname> not found in ~/.ssh/known_hosts" – Roily

@KashifNazar I am facing the same problem. I tried your solution, but ssh gives the following error: ssh: connect to host embs port 22: Connection refused, even when I'm specifying the port as -p 422. I checked the file /var/root/.ssh/known_hosts after running the command you suggested; it merely deleted the contents of the file, it did not put a new sha-key for the host. How do I fix this? I tried specifying the port in your command, like ssh-keygen -R [203.186.120.44]:422, but that didn't fix the issue either. – Curarize

<host> should be used with the exact value from the error message, in single quotes for shell-escaping. e.g.: ... host key for [example.com]:3422 has changed ... becomes ssh-keygen -R '[example.com]:3422' – Ansermet

Edit the host file Removes all keys belonging to hostname from a known_hosts file. – Newsdealer

This does nothing to fix the OP's problem: the managed file by sssd in '/var/lib/sss/pubconf/known_hosts' - it will instantly be recreated with the wrong key the second they try to ssh again. – Younglove

It may also be helpful to add quotes around the address, for example: ssh-keygen -R "[127.0.0.1]:3022" – Perjure

On Windows, just edit the known_hosts file that is mentioned in the git error and DELETE the line with the old IP. On the next connection to git server, it will ask you to confirm the new IP and all will be well again. – Unjust

For people getting not found error this might be happening because: There are usually several known_hosts file for each "user", meaning you might need to run the command as $root: ssh-keygen -R <xxx>, or $my-user: ssh-keygen -R <xxx>. – Boatel

In case you're using zsh and getting no matches found you need to wrap hostname with double quotes, so "[hostname]" - found it here apple.stackexchange.com/questions/411595/… – Typo

Now when I tried to pull I am getting the same error after this command – Plenipotent

GitHub recently updated theirs RSA SSH Host Key github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key – Cornetist

How do I know what <host> is? – Spotweld

@Spotweld Just to answer this since I same issue: I found it by physically opening the ~/.ssh/known_hosts. The IP is probably displayed there. But you could just cat ~/.ssh/known_hosts. Opening it as I did defeats the purpose of the command, since U might as well just delete it manually if you've had to physically find and open the file. – Fideicommissum

@MoteZart When I open ~/.ssh/known_hosts, there is nothing that looks like an IP addesses there; instead, I get rows that look like e.g. "|1|yWIW17YIg0wBRXJ8Ktt4mcfBqsk=|cFHOrZ8VEx0vdOjau2XQr/K7B/c= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFR293PJnDCj59XxfqYGctrMo60ZU5IOjACZZNRp9D6f". – Spotweld

@Spotweld For me most of the lines start with an IP: start of key(777.7777.777.77 ssh-ed25519 abcdegf....=)end of key. Sorry, I guess I don't truly know enough to have commented then :( – Fideicommissum

@MoteZart You can always comment and try to help, and even though the help would have been applicable for many people there may be exceptions for which it works differently. It's all part of sharing knowledge and learning yourself ;) – Spotweld

doesn't work, as <host> needs to be something else. Please try to be more specific with your answer, we can't read minds about what to write! – Barnyard

ssh-keygen -R [Host/IP] – Peaceful

@Lithic Using terminal from PowerShell is sufficient for this job – Mechanics

Answer 2

Use

ssh-keygen -R [hostname]

Example with an ip address/hostname would be:

ssh-keygen -R 168.9.9.2

This will update the offending of your host from the known_hosts. You can also provide the path of the known_hosts with -f flag.

Rundlet

Removing corresponding key $ ssh-keygen -R {server.name.com} | $ ssh-keygen -R {ssh.server.ip.address} | $ ssh-keygen -R server.example.com – Parson

Hostname clear example: ssh-keygen -R '[localhost]:2222' – Carlton

typically occurs when the unique fingerprint of your server does not match what was stored in your known_hosts file when you first connected. Use the following commands on Linux. s /home/username/.ssh use to see all the ssh keys. to see all the host fingerprints you have added previously cat /home/username/.ssh/known_hosts . You must delete one that is creating this issue. To remove one ssh-keygen -R [hostname]. If this does not work you can take backup cp -R /home/username/.ssh/known_hosts /home/username/.ssh/known_hosts.backup and delete rm -rf /home/username/.ssh/known_hosts – Encephalograph

What is [hostname]? Please be more specific. Use a specific example, like for GitHub pulls on macOS Sierra! – Barnyard

@ErikaElectra I was wondering the same, turms out it's was just "bitbucket.org" in my case, probably github.com in yours – Acoustic

But where should we use that command? i am getting host not found in terminal. – Mannerism

Answer 3

The sledgehammer is to remove every known host in one fell swoop:

rm ~/.ssh/known_hosts

---

On Monterey

sudo rm /var/root/.ssh/known_hosts

I come up against this as we use small subnets of short-lived servers from a jump box, and frequently have internal IP address reuse of servers that share the same ssh key.

Raimund

Worked for me on a vagrant VM when the accepted answer didn't work. – Dotson

Useful tool to have in the belt, but this could open you up for a MitM attack (the exact thing that known_hosts is meant to prevent). Only do this if you are confident that all of the hosts in there are safe. – And

This worked for me as well, after that I created host file again by running ssh sshuser@<ip address>, thanks – Toadstool

worked on my mac. – Phantasmal

I have a feeling to delete all known_hosts is not a super idea, it is needed to delete only needed fingerprint, but not all – Down

Answer 4

I had this same error occur after I recreated a Digital Ocean Ubuntu image. I used the following command with my server IP in place of [IP_ADDRESS]

ssh-keygen -R [IP_ADDRESS]

Myself

Thank you so much! I was using the host name and it only worked with the IP_ADDRESS :) – Illegalize

This did it for me and should be the accepted answer. I don't know why there are two copies of this answer that came later and both have more upvotes. – Oxonian

Yours was not the same error; your server wasn't running SSSD. See the OP. – Younglove

Answer 5

When you reinstall the server its identity changes, and you'll start to get this message. Ssh has no way of knowing whether you've changed the server it connects to, or a server-in-the-middle has been added to your network to sniff on all your communications - so it brings this to your attention.

Simply remove the key from known_hosts by deleting the relevant entry:

sed '4d' -i /var/lib/sss/pubconf/known_hosts

The 4d is on the account of Offending RSA ...known_hosts:4

Absurdity

Thanks, but I don't know why, but I remove it and it is in it again. I have tries stop sssd service and this effect gone, but after starting sssd, it appears again. – Risarise

Backup your ~/.ssh directory and then delete it. Does your service keeps re-adding the keys after ~/.ssh was blown away? – Absurdity

I have renamed .ssh to .ssh_old, after new try to connect it just create empty directory .ssh. And I still can't make /var/lib/sss/pubconf/known_hosts "editable". – Risarise

The more portable way to do this: sed -i -e 4d /var/lib/sss/pubconf/known_hosts – Chervonets

How do you backup the server's identification in the event that you wish to rebuild the server without causing disruptions like this error message? – Ceja

Answer 6

The problem is that you've previously accepted an SSH connection to a remote computer and that remote computer's digital fingerprint or SHA256 hash key has changed since you last connected. Thus when you try to SSH again or use github to pull code, which also uses SSH, you get an error. Why? Because you're using the same remote computer address as before but the remote computer is responding with a different fingerprint. Therefore, it's possible that someone is spoofing the computer you previously connected to. This is a security issue.

If you're 100% sure that the remote computer isn't compromised, hacked, being spoofed, etc then all you need to do is delete the entry in your known_hosts file for the remote computer. That will solve the issue as there will no longer be a mismatch with SHA256 fingerprint IDs when connecting.

On Mac here's what I did:

1) Find the line of output that reads RSA host key for servername:port has changed and you have requested strict checking. You'll need both the servername and potentially port from that log output.

2) Back up the SSH known hosts file cp /Users/yourmacusername/.ssh/known_hosts /Users/yourmacusername/.ssh/known_hosts.bak

3) Find the line where the computer's old fingerprint is stored and delete it. You can search for the specific offending remote computer fingerprint using the servername and port from step #1. nano /Users/yourmacusername/.ssh/known_hosts

4) CTRL-X to quit and choose Y to save changes

Now type ssh -p port servername and you will receive the original prompt you did when you first tried to SSH to that computer. You will then be given the option to save that remote computer's updated SHA256 fingerprint to your known_hosts file. If you're using SSH over port 22 then the -p argument is not necessary.

Any issues you can restore the original known_hosts file: cp /Users/yourmacusername/.ssh/known_hosts.bak /Users/yourmacusername/.ssh/known_hosts

Isoelectronic

That should be marked as accepted answer. Following those steps fixed my problem while ssh-keygen -R [IP_ADDRESS] didn't work for me. Thanks! – Morganica

Yeah, one of those cases that's not fair, best answer for sure. The 2nd and 3rd answers just repeat what the 1st said, and all of them have an incomplete solution. – Pyrite

and what if I am not sure that the remote computer is compromised? – Chan

Answer 7

Works for me!

Error: Offending RSA key in /var/lib/sss/pubconf/known_hosts:4

This indicates you have an offending RSA key at line no. 4

Solution 1:

1. vi /var/lib/sss/pubconf/known_hosts

2. remove line no: 4.

3. Save and Exit, and Retry.

Solution 2:

ssh-keygen -R "you server hostname or ip"

OR

Solution 3:

sed -i '4d' /root/.ssh/known_hosts

This will remove 4th line of /root/.ssh/known_hosts in place(-i).

Constabulary

This works for root's .ssh known_hosts file. Not for /var/lib/sss/pubconf/known_hosts, which is a managed file by SSSD, and populated by a remote server. – Younglove

on my case, for some reason, the issue happened on known_hosts*2*. Following these steps helped me to find that out, thanks @Sahil Gulati! – Nationalist

I tried Solution 3 but got error (sed: -I or -i may not be used with stdin), so switched to Solution 1 to solve for me. Overall still, this is the Best Answer +1! – Punchball

Answer 8

As many have already said, use ssh-keygen, i.e.

ssh-keygen -R pong

Also, you may like to consider temporarily turning off host key checking:

ssh -oStrictHostKeyChecking=no root@pong

Delative

what I'm using for the .ssh/config: Host ???? CheckHostIP no StrictHostKeyChecking no (3 lines, tabulated starting from the 2nd) – Schappe

Answer 9

updated your ssh key, getting the above message is normal.

Just edit ~/.ssh/known_hosts and delete line 4, as the message pointed you

Offending RSA key in /Users/isaacalves/.ssh/known_hosts:4

or use ssh-keygen to delete the invalid key

ssh-keygen -R "you server hostname or ip"

Synergistic

This is the simplest solution – Carthage

For those working on a mac. note that for smaller window sizes, the lines would not be literally. Lines start wherever there is a new host name – A1

Answer 10

I used the solution of mockinterface, though the sed -i didn't quite work I solved it by deleting the line by hand with vim:

sudo vim /var/lib/sss/pubconf/known_hosts

You can use any other text editor you want, but probably you'll need to show your administrative privileges

Aphaeresis

Yes, delete the record of same IP in the known_hosts file will resolve the issue. – Decibel

The entry is instantly recreated by SSSD when trying to ssh again. note that sss pubconf known_hosts is a managed file, not some local repository populated by the local server. – Younglove

Answer 11

Edit /home/hostname /.ssh/known_hosts,and delete the 4 lines, and save it.

Then run ssh root@pong again, you will see message like this:Are you sure you want to continue connecting (yes/no)? yes, just print yes.

Note: If you got some problem, read the hints first, it will help.

Erection

Answer 12

FINAL Solution!

It is showing due to the stored invalid ECDSA key. So we have to remove the ECDSA key from our master/controller machine by using the below command:

ssh-keygen -R 192.168.0.132

Here 192.168.0.132 is the remote system IP.

Stiff

there's no reason to have yet another duplicate answer here – Novelty

Answer 13

The other answers here are good and working, anyway, I solved the problem by deleting ~/.ssh/known_hosts. This certainly solves the problem, but it's probably not the best approach.

Stewpan

Answer 14

In my case it happened because I previously had ssh connection with a machine with same ip(say 192.152.51.10) and the system was considering the RSA key(stored in /home/user_name/.ssh/known_hosts) of the previous host which resulted in mismatch.

To resolve this issue, you have to remove previously stored RSA key for the ip 192.152.51.10.

ssh-keygen -f "/home/user_name/.ssh/known_hosts" -R 192.152.51.10

Bioastronautics

Answer 15

Simple one-liner solution, tested on mac:

sed '/212.156.48.110/d' ~/.ssh/known_hosts > ~/.ssh/known_hosts

Deletes only the target ssh host IP from know hosts.

where 212.156.48.110 is replaced by the target host IP address.

Cause: Happened because the target IP was already known for a different machine due to port forwarding. Deleting the target IP before connecting will fix the issue.

Gelya

Answer 16

This is because your remote computer settings have changed. Remove your current keys for that.

vim /root/.ssh/known_hosts

Delete the line of the IP you are connecting.

Kovno

Answer 17

I use PowerShell in Windows 10 for ssh.
My problem was in the Windows directory: C:\Users\youruser\.ssh
Delete the file known_hosts in that directory to forget the old value.

You may also use use File Explorer to locate and delete the file.

Bladderwort

Answer 18

Remove that the entry from known_hosts using:

ssh-keygen -R *ip_address_or_hostname*

This will remove the problematic IP or hostname from known_hosts file and try to connect again.

From the man pages:

-R hostname
Removes all keys belonging to hostname from a known_hosts file. This option is useful to delete hashed hosts (see the -H option above).

Felicitous

Answer 19

Sometimes, if for any reason, you need to reinstall a server, when connecting by ssh we will find that you server say that the identification has changed. If we know that it is not an attack, but that we have reinstated the system, we can remove the old identification from the known_hosts using ssh-keygen:

ssh-keygen -R <host/ip:hostname>
root/.ssh/known_hosts updated.
Original contents retained as /root/.ssh/known_hosts.old

When connecting again we will ask you to validate the new fingerprint:

ssh -l user <host/ip:hostname>
The authenticity of host '<host/ip:hostname>' can't 
be established.
RSA key fingerprint is 3f:3d:a0:bb:59:24:35:6d:e5:a0:1a:3f:9c:86:81:90.
Are you sure you want to continue connecting (yes/no)? yes

Abnormality

this is the best answer as it actually tells me what is happening and why I am doing it – Addle

Answer 20

If you are trying to connect to running docker container on port 2222 with the command and you get the error

mian@tdowrick2~$ ssh pos@localhost -p 2222

Then to solve this problem, on your local computer (i.e. host machine not container) go to cd ~/.ssh/ and open known_hosts file with text editor. Remove the line starting with [localhost]:2222 and save the file. Now try to ssh again

mian@tdowrick2~$ ssh pos@localhost -p 2222

Error will disappear but you have to do it each time the container restart.

Retired

Answer 21

My solution is:

1. vi ~/.ssh/known_hosts
2. delete the line that contains your want connected ip.

This is better than delete all of the known_hosts

Youngman

This is the same answer as miota85 below. – Vasya

Answer 22

My solution on UBUNTU (linux):

1.You have to delete the content from "known_hosts" file which is in /home/YOUR_USERNAME/.ssh/known_hosts

2.Generate a new ssh key like

ssh-keygen -t rsa -C "[email protected]" -b 4096

3.Copy-paste your new ssh key in your git repository (gitlab in my case) SSH keys.

It works for me!

Rhoden

Answer 23

I had this problem, and the reason is very simple, I have a duplicated IP address to ssh login, so after modify this problem, everthing is solved.

Chem

Answer 24

Only client side problem(duplicate key for ip):

Solve variants:

For clear one ip(default port 22):

ssh-keygen -f -R 7.7.7.7

For one ip(non default port):

ssh-keygen -f -R 7.7.7.7:333

Fast clear all ips:

cd ~; rm .ssh/known_hosts

7.7.7.7 - ssh your server ip connect

333 - non standart port

Ment

Answer 25

Just do:

cd /home/user/.ssh/ -> here user will be your username, i.e. /home/jon/ for example.

Then

gedit known_hosts & and delete the contents inside it.

Now ssh again, it should work.

Elliott

Answer 26

Use this command:

truncate -s 0 /home/SYSTEM_NAME/.ssh/known_hosts

Faxun

Please add an explanation what the command does and what it does not. – Vasya

Why would you want to truncate the file? You lose all information, even the information you've already verified. This is a bad method to act against a single changed public host key. – Vasya

Hint: This also deletes all other host information. If you are running automated scripts from your machine (like deployments), they might break because you have to manually reconfirm all host keys. Just to give a warning to other users here who are eager to use the easiest solution. – Sissy

Answer 27

Simply clear the known_hosts which is present in /home/{username}/.ssh/known_hosts

vi /home/{username}/.ssh/known_hosts 

remove every line inside known hosts and exit after that you will be able to login.

OR

run this command

ssh-keygen -R "hostname/ip_address" 

Mocha

Answer 28

I had the same error in my machine, and I clear the known_hosts file, and after that, it works fine.

Perichondrium

You don't want to delete your authorized_keys when you have a problem with the known_hosts file – Denigrate

Answer 29

SOLUTION:

1- delete from "$HOME/.ssh/known_hosts" the line referring to the host towards which is impossible to connect.

2- execute this command: ssh-keygen -R "IP_ADDRESSorHOSTNAME" (substitute "IP_ADDRESSorHOSTNAME" with your destination ip or destination hostname)

3- Retry ssh connection (if it fails please check permission on .ssh directory, it has to be 700)

Wilhite

Answer 30

AWS EC2.

Find the ip in the message it gives you.

run

vim /home/ec2-user/.ssh/known_hosts

Use the arrow keys to find the ip from the message and click.

dd

This will delete that line then run escape

:wp

This will save then you are good to go.

Capricorn

To resolve this issue go to C:\Users\username\.ssh and delete known_hosts file. – Alysaalyse