1175

I've reinstalled my server and I am getting these messages:

[user@hostname ~]$ ssh root@pong
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
6e:45:f9:a8:af:38:3d:a1:a5:c7:76:1d:02:f8:77:00.
Please contact your system administrator.
Add correct host key in /home/hostname /.ssh/known_hosts to get rid of this message.
Offending RSA key in /var/lib/sss/pubconf/known_hosts:4
RSA host key for pong has changed and you have requested strict checking.
Host key verification failed.

I have tried various solutions that I found on the Internet. My known_hosts file (normally in ~/.ssh/known_hosts) is in /var/lib/sss/pubconf/known_hosts. I've tried to edit it, but it remains in one state. I have installed ipa-client and have Fedora 19. How do I resolve this warning?

All the answers answered so far work only if you do not have Freeipa installed.

The right answer for freeipa in comments below from adrin is here.

21
  • 4
    There is a deadlock here. This one is marked duplicate so no one can add answer and the one it links is marked off topic so no can add answer there as well. If you delete the known_hosts, it will fix the issue as well.
    – zar
    Nov 2, 2015 at 20:57
  • 4
    As someone looking to verify their key first I found this answer useful. askubuntu.com/a/83499/620623 Dec 22, 2016 at 11:30
  • 27
    It seems that GitHub updated its RSA SSH host key for security reasons. If anyone is experiencing the same issue try to run ssh-keygen -R github.com command. Mar 24 at 6:11
  • 123
    If you're ending up on this question in March 2023, it's likely because GitHub just updated their RSA key. Details on what to do here: github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key Mar 24 at 11:14
  • 27

30 Answers 30

1831

Here is the simplest solution:

ssh-keygen -R <host>

For example,

ssh-keygen -R 192.168.3.10

From the ssh-keygen man page:

-R hostname Removes all keys belonging to hostname from a known_hosts file. This option is useful to delete hashed hosts (see the -H option above).

PS: For windows, execute this command in git bash

22
  • 10
    Alright, turns out on Windows I need to use terminal from git bash for this (or any MingW32 terminal). Tricky.
    – jaycode
    Apr 6, 2015 at 18:34
  • 55
    keep in mind that if you connected via a specific port, you might have to remove with syntax like ssh-keygen -R [127.0.0.1]:3022. Just check your .ssh/known_hosts file for what it explicitly says.
    – Adam Johns
    May 10, 2015 at 17:48
  • 11
    When I try this I get the error "<hostname> not found in ~/.ssh/known_hosts"
    – Nodeocrat
    Aug 15, 2017 at 9:04
  • 14
    <host> should be used with the exact value from the error message, in single quotes for shell-escaping. e.g.: ... host key for [example.com]:3422 has changed ... becomes ssh-keygen -R '[example.com]:3422' Jul 24, 2018 at 12:18
  • 2
    It may also be helpful to add quotes around the address, for example: ssh-keygen -R "[127.0.0.1]:3022"
    – Dilworth
    Mar 28, 2019 at 22:07
277

Use

ssh-keygen -R [hostname]

Example with an ip address/hostname would be:

ssh-keygen -R 168.9.9.2

This will update the offending of your host from the known_hosts. You can also provide the path of the known_hosts with -f flag.

6
  • 2
    Removing corresponding key $ ssh-keygen -R {server.name.com} | $ ssh-keygen -R {ssh.server.ip.address} | $ ssh-keygen -R server.example.com
    – DaddyMoe
    Oct 9, 2015 at 11:41
  • 3
    Hostname clear example: ssh-keygen -R '[localhost]:2222'
    – Pysis
    Jun 23, 2020 at 1:52
  • 1
    typically occurs when the unique fingerprint of your server does not match what was stored in your known_hosts file when you first connected. Use the following commands on Linux. s /home/username/.ssh use to see all the ssh keys. to see all the host fingerprints you have added previously cat /home/username/.ssh/known_hosts . You must delete one that is creating this issue. To remove one ssh-keygen -R [hostname]. If this does not work you can take backup cp -R /home/username/.ssh/known_hosts /home/username/.ssh/known_hosts.backup and delete rm -rf /home/username/.ssh/known_hosts
    – Md Shayon
    Mar 14 at 21:03
  • What is [hostname]? Please be more specific. Use a specific example, like for GitHub pulls on macOS Sierra! Apr 22 at 13:43
  • @ErikaElectra I was wondering the same, turms out it's was just "bitbucket.org" in my case, probably github.com in yours
    – Brumor
    Jun 21 at 12:17
148

I had this same error occur after I recreated a Digital Ocean Ubuntu image. I used the following command with my server IP in place of [IP_ADDRESS]

ssh-keygen -R [IP_ADDRESS]
3
  • Thank you so much! I was using the host name and it only worked with the IP_ADDRESS :)
    – J. Lopes
    Aug 5, 2017 at 18:53
  • 1
    This did it for me and should be the accepted answer. I don't know why there are two copies of this answer that came later and both have more upvotes. May 14, 2018 at 16:07
  • Yours was not the same error; your server wasn't running SSSD. See the OP.
    – Mercury00
    Mar 12, 2019 at 22:30
147

The sledgehammer is to remove every known host in one fell swoop:

rm ~/.ssh/known_hosts

On Monterey

sudo rm /var/root/.ssh/known_hosts

I come up against this as we use small subnets of short-lived servers from a jump box, and frequently have internal IP address reuse of servers that share the same ssh key.

5
  • Worked for me on a vagrant VM when the accepted answer didn't work.
    – 100pic
    Apr 3, 2018 at 3:57
  • 9
    Useful tool to have in the belt, but this could open you up for a MitM attack (the exact thing that known_hosts is meant to prevent). Only do this if you are confident that all of the hosts in there are safe. Jan 31, 2019 at 19:33
  • 1
    This worked for me as well, after that I created host file again by running ssh sshuser@<ip address>, thanks Feb 18, 2022 at 7:43
  • 1
    worked on my mac.
    – RwkY
    Sep 7, 2022 at 17:53
  • 2
    I have a feeling to delete all known_hosts is not a super idea, it is needed to delete only needed fingerprint, but not all Mar 24 at 9:34
55

When you reinstall the server its identity changes, and you'll start to get this message. Ssh has no way of knowing whether you've changed the server it connects to, or a server-in-the-middle has been added to your network to sniff on all your communications - so it brings this to your attention.

Simply remove the key from known_hosts by deleting the relevant entry:

sed '4d' -i /var/lib/sss/pubconf/known_hosts

The 4d is on the account of Offending RSA ...known_hosts:4

5
  • 1
    Thanks, but I don't know why, but I remove it and it is in it again. I have tries stop sssd service and this effect gone, but after starting sssd, it appears again. Dec 30, 2013 at 13:02
  • Backup your ~/.ssh directory and then delete it. Does your service keeps re-adding the keys after ~/.ssh was blown away? Dec 30, 2013 at 13:10
  • 1
    I have renamed .ssh to .ssh_old, after new try to connect it just create empty directory .ssh. And I still can't make /var/lib/sss/pubconf/known_hosts "editable". Dec 30, 2013 at 13:52
  • 5
    The more portable way to do this: sed -i -e 4d /var/lib/sss/pubconf/known_hosts
    – Pierz
    Feb 11, 2015 at 10:32
  • 2
    How do you backup the server's identification in the event that you wish to rebuild the server without causing disruptions like this error message?
    – Ninjaxor
    May 21, 2017 at 22:02
49

The problem is that you've previously accepted an SSH connection to a remote computer and that remote computer's digital fingerprint or SHA256 hash key has changed since you last connected. Thus when you try to SSH again or use github to pull code, which also uses SSH, you get an error. Why? Because you're using the same remote computer address as before but the remote computer is responding with a different fingerprint. Therefore, it's possible that someone is spoofing the computer you previously connected to. This is a security issue.

If you're 100% sure that the remote computer isn't compromised, hacked, being spoofed, etc then all you need to do is delete the entry in your known_hosts file for the remote computer. That will solve the issue as there will no longer be a mismatch with SHA256 fingerprint IDs when connecting.

On Mac here's what I did:

1) Find the line of output that reads RSA host key for servername:port has changed and you have requested strict checking. You'll need both the servername and potentially port from that log output.

2) Back up the SSH known hosts file cp /Users/yourmacusername/.ssh/known_hosts /Users/yourmacusername/.ssh/known_hosts.bak

3) Find the line where the computer's old fingerprint is stored and delete it. You can search for the specific offending remote computer fingerprint using the servername and port from step #1. nano /Users/yourmacusername/.ssh/known_hosts

4) CTRL-X to quit and choose Y to save changes

Now type ssh -p port servername and you will receive the original prompt you did when you first tried to SSH to that computer. You will then be given the option to save that remote computer's updated SHA256 fingerprint to your known_hosts file. If you're using SSH over port 22 then the -p argument is not necessary.

Any issues you can restore the original known_hosts file: cp /Users/yourmacusername/.ssh/known_hosts.bak /Users/yourmacusername/.ssh/known_hosts

3
  • 6
    That should be marked as accepted answer. Following those steps fixed my problem while ssh-keygen -R [IP_ADDRESS] didn't work for me. Thanks! Dec 6, 2017 at 18:50
  • Yeah, one of those cases that's not fair, best answer for sure. The 2nd and 3rd answers just repeat what the 1st said, and all of them have an incomplete solution.
    – brasofilo
    Apr 8, 2020 at 0:58
  • and what if I am not sure that the remote computer is compromised? Feb 22, 2022 at 13:11
25

As many have already said, use ssh-keygen, i.e.

ssh-keygen -R pong

Also, you may like to consider temporarily turning off host key checking:

ssh -oStrictHostKeyChecking=no root@pong
1
  • 4
    what I'm using for the .ssh/config: Host ???? CheckHostIP no StrictHostKeyChecking no (3 lines, tabulated starting from the 2nd)
    – XXL
    Sep 11, 2018 at 18:16
24

Works for me!

Error: Offending RSA key in /var/lib/sss/pubconf/known_hosts:4

This indicates you have an offending RSA key at line no. 4

Solution 1:

1. vi /var/lib/sss/pubconf/known_hosts

2. remove line no: 4.

3. Save and Exit, and Retry.

Solution 2:

ssh-keygen -R "you server hostname or ip"

OR

Solution 3:

sed -i '4d' /root/.ssh/known_hosts

This will remove 4th line of /root/.ssh/known_hosts in place(-i).

3
  • 1
    This works for root's .ssh known_hosts file. Not for /var/lib/sss/pubconf/known_hosts, which is a managed file by SSSD, and populated by a remote server.
    – Mercury00
    Mar 12, 2019 at 22:33
  • 1
    on my case, for some reason, the issue happened on known_hosts*2*. Following these steps helped me to find that out, thanks @Sahil Gulati!
    – Lucas
    Apr 15, 2019 at 17:19
  • 1
    I tried Solution 3 but got error (sed: -I or -i may not be used with stdin), so switched to Solution 1 to solve for me. Overall still, this is the Best Answer +1!
    – cellepo
    Mar 30 at 19:15
13

updated your ssh key, getting the above message is normal.

Just edit ~/.ssh/known_hosts and delete line 4, as the message pointed you

Offending RSA key in /Users/isaacalves/.ssh/known_hosts:4

or use ssh-keygen to delete the invalid key

ssh-keygen -R "you server hostname or ip"
2
  • This is the simplest solution Mar 25 at 1:04
  • For those working on a mac. note that for smaller window sizes, the lines would not be literally. Lines start wherever there is a new host name Apr 30 at 2:28
11

I used the solution of mockinterface, though the sed -i didn't quite work I solved it by deleting the line by hand with vim:

sudo vim /var/lib/sss/pubconf/known_hosts

You can use any other text editor you want, but probably you'll need to show your administrative privileges

2
  • 1
    Yes, delete the record of same IP in the known_hosts file will resolve the issue.
    – wherby
    Oct 28, 2015 at 11:35
  • The entry is instantly recreated by SSSD when trying to ssh again. note that sss pubconf known_hosts is a managed file, not some local repository populated by the local server.
    – Mercury00
    Mar 12, 2019 at 22:32
11

FINAL Solution!

It is showing due to the stored invalid ECDSA key. So we have to remove the ECDSA key from our master/controller machine by using the below command:

ssh-keygen -R 192.168.0.132

Here 192.168.0.132 is the remote system IP.

1
  • 1
    there's no reason to have yet another duplicate answer here May 26 at 5:56
10

Edit /home/hostname /.ssh/known_hosts,and delete the 4 lines, and save it.

Then run ssh root@pong again, you will see message like this:Are you sure you want to continue connecting (yes/no)? yes, just print yes.

Note: If you got some problem, read the hints first, it will help.

0
9

The other answers here are good and working, anyway, I solved the problem by deleting ~/.ssh/known_hosts. This certainly solves the problem, but it's probably not the best approach.

8

In my case it happened because I previously had ssh connection with a machine with same ip(say 192.152.51.10) and the system was considering the RSA key(stored in /home/user_name/.ssh/known_hosts) of the previous host which resulted in mismatch.

To resolve this issue, you have to remove previously stored RSA key for the ip 192.152.51.10.

ssh-keygen -f "/home/user_name/.ssh/known_hosts" -R 192.152.51.10
8

Simple one-liner solution, tested on mac:

sed '/212.156.48.110/d' ~/.ssh/known_hosts > ~/.ssh/known_hosts

Deletes only the target ssh host IP from know hosts.

where 212.156.48.110 is replaced by the target host IP address.

Cause: Happened because the target IP was already known for a different machine due to port forwarding. Deleting the target IP before connecting will fix the issue.

7

This is because your remote computer settings have changed. Remove your current keys for that.

vim /root/.ssh/known_hosts

Delete the line of the IP you are connecting.

7

I use PowerShell in Windows 10 for ssh.
My problem was in the Windows directory: C:\Users\youruser\.ssh
Delete the file known_hosts in that directory to forget the old value.

You may also use use File Explorer to locate and delete the file.

6

Remove that the entry from known_hosts using:

ssh-keygen -R *ip_address_or_hostname*

This will remove the problematic IP or hostname from known_hosts file and try to connect again.

From the man pages:

-R hostname
Removes all keys belonging to hostname from a known_hosts file. This option is useful to delete hashed hosts (see the -H option above).

5

Sometimes, if for any reason, you need to reinstall a server, when connecting by ssh we will find that you server say that the identification has changed. If we know that it is not an attack, but that we have reinstated the system, we can remove the old identification from the known_hosts using ssh-keygen:

ssh-keygen -R <host/ip:hostname>
root/.ssh/known_hosts updated.
Original contents retained as /root/.ssh/known_hosts.old

When connecting again we will ask you to validate the new fingerprint:

ssh -l user <host/ip:hostname>
The authenticity of host '<host/ip:hostname>' can't 
be established.
RSA key fingerprint is 3f:3d:a0:bb:59:24:35:6d:e5:a0:1a:3f:9c:86:81:90.
Are you sure you want to continue connecting (yes/no)? yes
1
  • 1
    this is the best answer as it actually tells me what is happening and why I am doing it
    – Stretch
    Jan 4, 2022 at 1:06
4

If you are trying to connect to running docker container on port 2222 with the command and you get the error

mian@tdowrick2~$ ssh pos@localhost -p 2222

Then to solve this problem, on your local computer (i.e. host machine not container) go to cd ~/.ssh/ and open known_hosts file with text editor. Remove the line starting with [localhost]:2222 and save the file. Now try to ssh again

mian@tdowrick2~$ ssh pos@localhost -p 2222

Error will disappear but you have to do it each time the container restart.

3

My solution is:

  1. vi ~/.ssh/known_hosts
  2. delete the line that contains your want connected ip.

This is better than delete all of the known_hosts

1
  • This is the same answer as miota85 below.
    – Daniel W.
    Jan 7, 2019 at 12:42
3

My solution on UBUNTU (linux):

1.You have to delete the content from "known_hosts" file which is in /home/YOUR_USERNAME/.ssh/known_hosts

2.Generate a new ssh key like

ssh-keygen -t rsa -C "[email protected]" -b 4096

3.Copy-paste your new ssh key in your git repository (gitlab in my case) SSH keys.

It works for me!

2

I had this problem, and the reason is very simple, I have a duplicated IP address to ssh login, so after modify this problem, everthing is solved.

2

Only client side problem(duplicate key for ip):

Solve variants:

For clear one ip(default port 22):

ssh-keygen -f -R 7.7.7.7

For one ip(non default port):

ssh-keygen -f -R 7.7.7.7:333

Fast clear all ips:

cd ~; rm .ssh/known_hosts

7.7.7.7 - ssh your server ip connect

333 - non standart port

2

Just do:

cd /home/user/.ssh/ -> here user will be your username, i.e. /home/jon/ for example.

Then

gedit known_hosts & and delete the contents inside it.

Now ssh again, it should work.

2

Use this command:

truncate -s 0 /home/SYSTEM_NAME/.ssh/known_hosts
3
  • Please add an explanation what the command does and what it does not.
    – Daniel W.
    Jan 7, 2019 at 10:21
  • 6
    Why would you want to truncate the file? You lose all information, even the information you've already verified. This is a bad method to act against a single changed public host key.
    – Daniel W.
    Jan 7, 2019 at 12:40
  • Hint: This also deletes all other host information. If you are running automated scripts from your machine (like deployments), they might break because you have to manually reconfirm all host keys. Just to give a warning to other users here who are eager to use the easiest solution.
    – Mateng
    Jul 5, 2019 at 7:40
2

Simply clear the known_hosts which is present in /home/{username}/.ssh/known_hosts

vi /home/{username}/.ssh/known_hosts 

remove every line inside known hosts and exit after that you will be able to login.

OR

run this command

ssh-keygen -R "hostname/ip_address" 
1

I had the same error in my machine, and I clear the known_hosts file, and after that, it works fine.

1
  • 1
    You don't want to delete your authorized_keys when you have a problem with the known_hosts file
    – jeb
    Dec 20, 2019 at 14:08
0

SOLUTION:

1- delete from "$HOME/.ssh/known_hosts" the line referring to the host towards which is impossible to connect.

2- execute this command: ssh-keygen -R "IP_ADDRESSorHOSTNAME" (substitute "IP_ADDRESSorHOSTNAME" with your destination ip or destination hostname)

3- Retry ssh connection (if it fails please check permission on .ssh directory, it has to be 700)

-1

AWS EC2.

Find the ip in the message it gives you.

run

vim /home/ec2-user/.ssh/known_hosts

Use the arrow keys to find the ip from the message and click.

dd

This will delete that line then run escape

:wp

This will save then you are good to go.

1
  • To resolve this issue go to C:\Users\username\.ssh and delete known_hosts file. Jun 21 at 6:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.