63 comment

1. It’s not necessary to delete the entire known_hosts file, just the offending line in that file.

   Using your example, all you need to do is:

   vi ~/.ssh/known_hosts
   1G
   dd
   :wq

   And done. This is helpful if you manage a large group of servers and have *many* keys cached. If you delete the entire file, you will br prompted to add the server’s key on each connection attempt.

   1. I have an easier way to just delete the one offending key:

      EXAMPLE: sed -i ‘2d’ .ssh/known_hosts

      Just replace the 2 in the example above with whatever line it says contains the offending key.

      1. +1 to what Paul said, who beat me too it.

   2. Yes this was the best and easiest solution out of all.

      thanks

2. Chris,

   Good point / tip, if I have 100’s of ssh server; it will be a problem for me.

   Appreciate your post.

3. The right way to do this is with “ssh-keygen -R ip-address”.

   –Amos

   1. Cool, I’ll try that next time….Thanks Amos!

   2. Thanks Amos its working fine:)

   3. Thank you! It worked :)

      – Patrick

4. Theres actually a script that does this at
   http://blog.hacker.dk/2008/01/script-to-fix-ssh-host-identification-changed/

   Aparently it doesnt use the sshkeygen, but it does the work nicely and easy:
   script

5. thanks Amos for the correct way to update rsa host keys.

6. Thanks for nice solution.

   The above mentioned problem I face when remote computer completely formated and they give us again ssh connection. And because of RSA digital signature of computer identification the local computer does not accept the remote computer (as I think).

   Once again thanks for solution.

   Regards,
   Deepen

7. Thanks, your solution worked for my SSH login. Currently still can’t log in properly through my ltsp server. It says it is checking the password and then ends the session. I definitely have a link to the server (i.e. and address) Any ideas about this? Thank-you in advance.

8. It works fo me :)
   vi ~/.ssh/known_hosts
   dd
   :wq

   1. dd worked for me too, tks.

9. Thanks for the solution

10. Hi,
    I’m getting the same error. I compared the RSA keys in my known_hosts file with the host key of the remote computer….they are the same. I thought I’d find out if it is a genuine MITM attack or not, so I shut down the SSH server on the remote machine and accepted the newly presented key. Connection to the remote machine now yields a “Permission denied” message, since I use public-private key authentication.

    Does this mean that I am, in fact, being subjected to a MITM attack?

    Thanks.

11. Above mentioned problem was solved. I restarted the remote machine, and everything started working properly..

    Weird….

12. Thanks. Good job.

13. Thanks….it’s works for my.greetings from argentine!!! bye

14. I had same problem.,, i tried to used Amos Sapira suggest.
    #ssh-keygen -R ip_that_have_problem

    and.. IT WORKS..
    thanx a lot guys…
    Regard … TGUNTARA

15. just for help :
    the port of a ssh wasn’t 22.
    I need to ssh-keygen -R [ip]:port
    (keep the ‘[‘)

16. in my case I had another problem:
    I had set the options
    UserKnownHostsFile=no
    StrictHostKeyChecking=no
    in my config and this prevented the new host to be added to known_hosts. I got the error every time I tried to contact the host and never got a prompt to add it to known hosts.

17. Big help especially solution number 3. :)
    Finally get rid of that error message. Made me really paranoid of the “eavesdropping” thing.

    Thanks a lot for the tip.

18. hi, thansk a lot.. solution 3 worked :)

19. got one better for you.

    ssh -1 host fails, asking for password, even though pub key is correct on remote host.
    subsequent ssh -1 host fails with man-in-the-middle warning. this is an endless cycle.

    ssh -2 host works fine from the command line. from the veritas netbackup NBU_include.pl script, that same command fails on auth error.

    ;-)

20. Thanks, very helpful

    1. thanks

21. thanks for the solution to this! I used:
    vi ~/.ssh/known_hosts
    dd
    :wq

22. thanks for solutions

23. Thank you for the post, this helped me get back into my ipod 2 gen after I messed up badly by accidentally removing the folder labeled System. You’re awesome!

24. Thanks. I never knew about ssh-keygen -r {IP-Address}

25. Thanks for the solo, quick & painless! Appreciate it!

26. it’s work for me, tks!

27. Hi guys,

    thanks fo rthe solution I have also one query when I am doing vncviewer 10.1.1.1:3 (example) then I am getting the message “vncviewer : unable to open dislpay ‘0.0’ “.
    what may be the problem . I checked with echo $DISPLAY >>> it is 0.0.

28. This article was helpful. Thanks

29. Thanks Men, this has worked for me

30. Thanks a lot for the solution , It has worked for me .

31. Thanks very much!! That fixed my ssh problem.

32. Thanks for the solution. Option 1 worked like a charm.

33. Amazing, it resolved…

    Used this method…
    $ ssh-keygen -R server.example.com

34. gracias

35. Hi Vivek, these articles have been very helpful to me. Thank you very much !
    Your website rocks!

36. Thanks; solution 1 saved my day !

37. thanks solution #1 saved me.

38. So – I can’t really tell you if any of these solutions work. There’s another Problem in my warning message:

    It says:
    “Add correct host key in /Users/jannis/.ssh/known_hosts to get rid of this message.”

    Buuut – there is no directory called “/Users/jannis/….” – so I can’t really find this file.
    By the way: the file isn’t in my home directory either.

    Please tell me anybody has a solution for this D:

39. Thanks for providing multiple solutions to the same problem :)

40. Thanx very helpful info.It help me thanx again..:)

41. Hey There.

    I encountered this same issue with a reinstalled ubuntu server. None of the three solutions above worked for me but I found a solution that did. The problem was that there was no known_hosts file at all. So, using an ftp client I created the .ssh folder in my user director and then added a file called known_hosts. BEFORE editing the file I tried to ssh in to my server and presto, it worked. Hopefully this helps someone else out.

42. I was booting the same hardware with different media, so completely different OSs and needed BOTH ssh keys to work. The solution
    ssh-keyscan -t rsa ip_address >> ~/.ssh/known_hosts

43. Thank you – I’m very new to networking at this level, this advice was priceless.

    Page bookmarked.

    O

44. So I have been hunting for an answer to “how do you determine if the key has actually changed, or you are subject to MITM?”

    I haven’t changed the remote server’s keys, and I have confirmed that the fingerprint matches, so I am now stuck – what should I do?

45. the 3° solution was correct for me ;)
    thanks.

46. Thank you friend for your support.

47. Thanks …..nice solution…i would like to thanks nixCraft team ….. i m always found the correct explanations and solutions from here ………thanks a lot…..keep it up…

48. try this below command and its working for me.
    ssh-keygen -R

49. Since I do a lot of internal testing and re-imaging of servers where I SSH to these servers quite a bit I’d rather not delete the offending key in known hosts, delete the all the files I run this:

    ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@

50. Many Thanks.
    Its Work

51. Thanks! Worked for me while using mobaXTerm

52. Open File manager, enter to /home/user/ssh/ and open file known_host. edit file and remove content. finish: saving
    Olala… resolved.

53. thanks , it was really helpful.

54. What to do when the “bad” key is not in the normal place $HOME/.ssh/known_hosts, but it’s located in /var/lib/sss/pubconf/known_hosts? No solution works.

    1. The syntax is:
       ssh-keygen -f /var/lib/sss/pubconf/known_hosts -R ip_address_here
ssh-keygen -f /var/lib/sss/pubconf/known_hosts -R host-example-com
       Or Edit file with a text editor such as vi:
       vi /var/lib/sss/pubconf/known_hosts
       And delete the line.

    Still, have a question? Get help on our forum!