Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I run an Ubuntu desktop with a bunch virtual test servers in Virtual Box to test stuff out etc. In the past I've also been connecting to other kinds of remote VPS Linux boxes. Currently my .ssh/known_hosts file has a whole bunch of keys in them, most are not being used any more.

I want to clean up my .shh/known_hosts file but how do I know which key belongs to what host? I.e. how do I know which keys I can safely remove and which ones I should leave alone?

share|improve this question
up vote 40 down vote accepted

To find out which entry is for a known hostname in known_hosts:

 # ssh-keygen -H  -F <hostname or IP address>

To delete a single entry from known_hosts:

 # ssh-keygen -R <hostname or IP address>
share|improve this answer

If you've got a list of all your hosts, you can do something like

ssh-keyscan -t rsa,dsa -f list_of_hosts > ~/.ssh/known_hosts

That will overwrite your .ssh/known_hosts file with a newly generated one based on scanning the hosts.

And also do what theotherreceive suggests; HashKnownHosts is more annoyance than help here.

share|improve this answer
ssh-keyscan has a very strict formatting rules of the list_of_hosts file. It needs to be be just the addres and no other whitespace then LF after each address. That includes LF after last address. Otherwise you get a lot of trash in the generated file. – Nux Feb 23 at 14:25

With difficulty...

Ubuntu by default hashes hostnames the known_hosts file (this is not the default openssh behaviour), to make it difficult for anyone reading the file to know what systems you access.

If you really wanted to clean out the file, simplest option is probably just delete it and check the keys for servers you know as they arise, but really I'd just leave known_hosts alone.

You can stop new hosts entries from being hashed by commenting out the option in /etc/ssh/ssh_config

#HashKnownHosts yes
share|improve this answer
Cleaning up ~/.ssh/known_hosts also helps when the configuration of the remote host changes and ssh shows a warning. However one should be careful with that and ignore the warnnig only for trusted hosts. – Alex Aug 28 '09 at 8:28
A better option might be to explain how to generate the hash for a specific hostname, allowing him to search for that hash in known_hosts so he can update it. – Cerin Feb 6 '12 at 15:58
After above change just add a new entry e.g. by connecting to new server with ssh root@something-new-or-new-dns-alias. This will refresh the original known_hosts file and de-crypt the host names/IPs. – Nux Feb 23 at 14:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.