How to Fix ‘Host Key Verification Failed’ in SSH

Attempting to connect to a remote server, cloud instance, or Raspberry Pi via Secure Shell (SSH) only to be blocked by a prominent security warning: “@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Host key verification failed” halts terminal access. In the OpenSSH security model, Trust On First Use (TOFU) ensures that when you connect to a server, its cryptographic public host key is permanently recorded in your local known_hosts file. If the remote host is later reinstalled, assigned a reused IP address, or configured with a new SSH keypair, the cryptographic signature no longer matches the stored fingerprint. OpenSSH halts execution immediately to protect against potential Man-in-the-Middle (MITM) attacks. This tutorial explains how to verify server legitimacy, remove stale host keys, and restore SSH connectivity safely.

Why Does OpenSSH Raise Host Key Verification Failures?

Before bypassing this warning, it is critical to determine whether the key change is expected:

• Server Reinstallation or OS Re-image: Reinstalling Ubuntu, Debian, or Rocky Linux on a server generates brand new SSH host keypairs, while the IP address remains identical.
• Cloud Dynamic IP Re-allocation: In cloud environments (such as AWS EC2, DigitalOcean, or Azure), releasing and provisioning virtual instances often reassigns previously used IP addresses.
• Hardware Replacement or Router Port Forwarding: Port forwarding on a local router pointing port 22 to a different internal device on the network.
• Genuine Man-in-the-Middle (MITM) Attacks: An unauthorized third party intercepting network traffic and presenting a spoofed server certificate.

Method 1: Remove the Stale Host Key Using ssh-keygen -R (Recommended)

The standard and safest method to update your known_hosts file is using the built-in ssh-keygen utility.

1. Review the exact error output in your terminal. Note the offending IP address or hostname and the line number cited (e.g. Offending key in /home/user/.ssh/known_hosts:14).
2. Execute the following command, replacing the target with your server’s IP address or hostname:

   ssh-keygen -R 192.168.1.100

3. The utility will locate the stale key, remove it, and create a backup file at ~/.ssh/known_hosts.old.
4. If you connect via a non-standard port (such as 2222), specify the port in brackets:

   ssh-keygen -R "[192.168.1.100]:2222"

5. Reconnect to your server:

   ssh [email protected]

6. Verify the new fingerprint displayed matches your server console output, type yes, and press Enter.

Method 2: Manually Remove the Offending Line Using sed

If you prefer an automated single-command fix based on the specific line number reported in the warning.

1. Identify the line number from the warning dialogue (for example, line 27).
2. On Linux and macOS, use sed to delete that exact line from known_hosts:

   sed -i.bak '27d' ~/.ssh/known_hosts

3. This removes line 27 while creating a backup copy named known_hosts.bak.
4. Initiate your SSH connection again to register the new valid host fingerprint.

Method 3: Fetch and Update the Server Fingerprint via ssh-keyscan

If you manage automated scripts or batch hosts, fetch the fresh public key directly from the remote server.

1. Query the remote host for its current public key:

   ssh-keyscan -H -t ed25519,rsa 192.168.1.100 >> ~/.ssh/known_hosts

2. This appends the current verified public key directly to your local database, eliminating subsequent verification prompts.

Method 4: Temporary Bypass for Ephemeral Cloud Environments

When spinning up automated CI/CD virtual machines that constantly cycle IP addresses, bypass strict host checking temporarily for that session.

1. Execute your connection using command-line override flags:

   ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null [email protected]

2. Caution: Never use this parameter for production environments or over untrusted public Wi-Fi networks, as it disables MITM protections.

Diagnostic Summary for SSH Key Verification

Tool / Technique	Command Example	Primary Use Case
ssh-keygen -R	ssh-keygen -R 192.168.1.50	Safely removes stale key and creates automatic backup
sed -i 'Nd'	sed -i '12d' ~/.ssh/known_hosts	Deletes specific line cited in the error output
ssh-keyscan	ssh-keyscan -H host >> known_hosts	Fetches and appends current remote fingerprint
StrictHostKeyChecking=no	ssh -o StrictHostKeyChecking=no ...	Ephemeral disposable testing environments

Following these standard cryptographic key management practices safely resolves host key verification blocks while maintaining strict network security.