WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

Printed as a block between lines of `@` characters, followed by the new key's fingerprint, the offending known_hosts line and "Host key verification failed.".

OpenSSH client — host key differs from the one recorded in known_hosts

What it means

The server presented a host key that differs from the one recorded for this host name or address in `known_hosts`. ssh cannot tell a legitimate change (reinstall, new machine behind the same IP) from someone intercepting the connection, so it refuses to continue in batch mode and disables password and keyboard-interactive authentication otherwise. The "Offending … key in …:N" line tells you which known_hosts line holds the old key.

Why it happens

• The server was rebuilt

  common

  A reinstall, an image-based redeploy or a container that generates host keys at start creates new host keys under the same name.

• The address now belongs to another machine

  common

  Cloud IP addresses and DHCP leases are recycled. An entry recorded by IP keeps the old machine's key.

• Several hosts with different keys behind one name

  occasional

  Round-robin DNS or a TCP load balancer in front of servers that do not share host keys makes the warning appear randomly.

• Someone is in the middle

  rare

  Rare, but exactly what the check is for: a compromised network, a malicious Wi-Fi or a DNS takeover answering with its own key. Verify before you accept.

How to fix it

1. 1.

   Verify the new key, then replace the entry

   Compare the new fingerprint with one from a trusted source; only then remove the old line with `ssh-keygen -R` (by name and by IP).

   # 1. Get the new fingerprint from a trusted channel (cloud console, provisioning logs, the admin)
   ssh-keyscan -t ed25519 server.example.com 2>/dev/null | ssh-keygen -lf -
   # 2. Only if it matches: remove the old entry and connect again
   ssh-keygen -R server.example.com
   ssh-keygen -R 203.0.113.10

2. 2.

   Use SSH host certificates for fleets

   Clients that trust a host CA accept rebuilt servers whose new keys are signed by the CA, without per-host pinning.

   # known_hosts: trust host keys signed by your SSH CA instead of pinning each key
   @cert-authority *.internal.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... ssh-host-ca

← Browse the full signature error database