Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why or why am I getting this error on server A trying to connect to server B?????

Warning: the ECDSA host key for '' differs from the key for the IP address ''
Offending key for IP in /root/.ssh/known_hosts:4
Matching host key in /root/.ssh/known_hosts:5
Are you sure you want to continue connecting (yes/no)? no
Host key verification failed.
enter code here

On server A I do this

eval `ssh-agent -s`
ssh-keyscan | tee -a /root/.ssh/known_hosts

Then I try and ssh. Wow..both servers event have the same pub and private keys. I am trying to set passwordless auth between servers.

share|improve this question
The servers shouldn't both have the same private key. – Craig McQueen Sep 9 '15 at 0:24
up vote 2 down vote accepted

It appears that some of your hosts have changed IP's recently and you've connected to them after and before the IP changes.

I would recommend you to cleanup your known_hosts file in the lines 4 and 5 to get rid of this error message.

Another thing to consider is: if you only want Server A connecting to Server B you just need to drop the Server A Public Key (the contents of or in /root/.ssh/authorized_keys of Server B.

If you do want bidirectional connection you should do the same procedure for Server B to A.

share|improve this answer
I want bi-directional. I DROP the /root/.ssh/authorized_keys on both servers? – Tampa Apr 25 '14 at 1:56
how do I drop the keys? – Tampa Apr 25 '14 at 2:08
Considering you have a RSA key, just take the contents of from Server A to authorized_keys in Server B. Do a scp in the file from A to B. Then: cat >> /root/.ssh/authorized_keys ; and vice-versa. – Vinícius Ferrão Apr 25 '14 at 2:31
Do I still use ssh-keyscan | tee -a /root/.ssh/known_hosts? Or remove? – Tampa Apr 25 '14 at 2:36
Remove lines four and five as I said from the known_hosts file. – Vinícius Ferrão Apr 25 '14 at 3:15

From ssh_config(5) man page,there is one PATTERNS


If this flag is set to "yes", ssh(1) will additionally check the host IP address in the known_hosts file. This allows ssh to detect if a host key changed due to DNS spoofing. If the option is set to "no", the check will not be executed. The default is "yes".

so,you can put CheckHostIP no in your /etc/ssh/ssh_config file.

as @Vinícius Ferrão say,it is not secure. best idea is put CheckHostIP no in your ~/.ssh/config is a sample:

Host bar.local bar
    Hostname bar.local
    CheckHostIP no

you should do the same operation on A and B.i think it is a best idea with DHCP enabled network.

share|improve this answer
It's never a good option to disable this! – Vinícius Ferrão Apr 25 '14 at 3:16
yes, you are can Put CheckHostIP no in your ~/.ssh/config file is good this: <pre>Host Hostname CheckHostIP no</pre> – 7rack Apr 25 '14 at 3:20

We fixed our similar issue by removing old entries on know_hosts files.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.