my laptop apparently has changed its RSA key, so when I connect to it over SSH, I get the message of REMOTE HOST IDENTIFICATION HAS CHANGED.

I don't remember if the last time I've connected to my laptop was before reinstalling something, so would like to know if there is a record of the timestamp when I trusted the key of my laptop for the last time.



The .ssh/known_hosts file doesn't timestamp the hosts as they are added. The modification timestamp of the file itself would point to the most recent possible time that the host was added, though.

  • Thanks man. If my known_hosts is hashed, how could I check whether the last entry is my laptop? – bernardo Aug 25 '13 at 19:44
  • The error message tells you which line is the line it found matching your laptop. – DerfK Aug 26 '13 at 12:24

Whenever you get this message "REMOTE HOST IDENTIFICATION HAS CHANGED" here public key fingerprint play important role. I wrote on this topic in this link Now as per your question,you want to know when the known_hosts file was updated after trusting the key which means when the known_hosts file was updated with new public key fingerprint.

Here you have to check two files in target machine. (1) /etc/ssh/ssh_host_rsa_key.pub (It keeps public key finger print information) (2) Check /var/log/auth.log in Debian and Ubuntu, In Red Hat and CentOS /var/log/secure

(1) Get detail when the file /etc/ssh/ssh_host_rsa_key.pub get last modified. Below command will give you date and time stamp means when new public key fingerprint updated

stat /etc/ssh/ssh_host_rsa_key.pub

(2) Now check in auth.log or secure file when you accessed the machine via ssh.

Hence,you have to find out when ssh access from client has happened after modify date time stamp of file /etc/ssh/ssh_host_rsa_key.pub. The nearest date time stap will be your answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.