12

When I execute:

ssh root@myVPS

I'm getting the next warning:

Warning: the RSA host key for 'myVPS' differs from the key for the IP address 'xxx.xx.xxx.xx'
Offending key for IP in /home/manolo/.ssh/known_hosts:1
Matching host key in /home/manolo/.ssh/known_hosts:2
Are you sure you want to continue connecting (yes/no)?

and if I type "yes" I works fine, but I don't know why this warning is thrown. Any suggestion of why is it thrown and how to avoid it?

Improve this question
2
  • There are two different host keys for the same IP address in the known_hosts file, one of them matches the other one is outdated. You can just use vim +1 ~/.ssh/known_hosts and remove the first line with : dd The line where the offending key is located is the one after the colon, thus line 1 in this case.
    – runlevel0
    Aug 2, 2017 at 11:06
  • :1 means line 1, :2 means line two. Offending key on line 1 is the line you need to delete.
    – run_the_race
    Nov 19, 2020 at 20:51

5 Answers 5

Reset to default
30

Most likely, you'll have reinstalled your VPS at some point and kept the host name and/or IP address. When reinstalling, the host key of the VPS got regenerated and since it differs from the one in your ~/.ssh/known_hosts, the warning gets displayed so you can detect the problem. This is done to prevent you from connecting to an entirely different system that replaces the legitimate host, e.g. to collect passwords.

If something like that happened, just remove the offending key from your known_hosts file and everything is fine, but if you are not aware of such an rinstall, you have to investigate further do understand why the key differs.

Improve this answer
4
  • 1
    Yes. This is the case. But how to know what to remove in ~/.ssh/known_hosts. There are a lot of letters in this file.
    – Manolo
    Sep 11, 2013 at 13:05
  • 6
    You can remove them with ssh-keygen -R, see the man page for more infos.
    – Sven
    Sep 11, 2013 at 13:12
  • 11
    All right! I've done ssh-keygen -R ip_address and warning have disappeared.
    – Manolo
    Sep 11, 2013 at 13:47
  • I am facing this issue while doing an ssh to my server which is a dedicated ubuntu machine. I don't think that anything on that server was changed recently. But since there are many people using this machine with sudo access I cannot be very sure. Can someone point me how should I ensure that nothing was compromised?
    – Nikhil Bhandari
    Nov 2, 2015 at 6:14
2

I had the same problem, and it is very easy to resolve. Please open your known_hosts file from vi .ssh/known_hosts and search for your server name. If you find the host key is there without the IP address, then add your IP to that file and it will resolve your issue. Before:

myVPS ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAsIfCSqA2rSlTvH8AMrMjpD66y5dOsYOPp30AXYGAEAFkVBs1+51lbRNyiFenpbxOyQjyvpgVJdkC4kqgG66xE6IPBrqpUFL3KjbUCTZ8sNHWn+I89bAMWDzGEiqaad/powDxgZgFe74bV82Se1igbFmHlHwwb7DEAcjXh34XbcMgJ0vIExJqPV1zccKkCXhstQy7av0+I7GRz5wIbYiIFMungKIhX3upwQOzyW/E1RDmq89BRv1g2ch1xsKK5OpNjCCFP2OSYPybJmFXhjOWI7LUdFASmaw5Z1az9LLpLKQePQ4mWsL/ON8Z9uvzhQig3hdQ/cnrAsRLShn4rJratw==

After adding IP:

myVPS,198.51.100.42 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAsIfCSqA2rSlTvH8AMrMjpD66y5dOsYOPp30AXYGAEAFkVBs1+51lbRNyiFenpbxOyQjyvpgVJdkC4kqgG66xE6IPBrqpUFL3KjbUCTZ8sNHWn+I89bAMWDzGEiqaad/powDxgZgFe74bV82Se1igbFmHlHwwb7DEAcjXh34XbcMgJ0vIExJqPV1zccKkCXhstQy7av0+I7GRz5wIbYiIFMungKIhX3upwQOzyW/E1RDmq89BRv1g2ch1xsKK5OpNjCCFP2OSYPybJmFXhjOWI7LUdFASmaw5Z1az9LLpLKQePQ4mWsL/ON8Z9uvzhQig3hdQ/cnrAsRLShn4rJratw==
Improve this answer
1

You have to clear both the hostname and the ip address from your known_hosts file, you can do it like this:

ssh-keygen -f ~/.ssh/known_hosts -R [somehostname.net]
ssh-keygen -f ~/.ssh/known_hosts -R [123.123.123.123]

Just replace somehostname.net with the hostname or domain name of the host you want to clear, and replace the ip address with the hosts ip address (leave the square brackets in). If it worked you will see a message like this:

/home/yourname/.ssh/known_hosts updated.
Original contents retained as /home/yourname/.ssh/known_hosts.old

If it didn't work, try the same thing but without the square brackets, also double check that the hostname and ip address is correct:

ssh-keygen -f ~/.ssh/known_hosts -R somehostname.net
ssh-keygen -f ~/.ssh/known_hosts -R 123.123.123.123

If the host's SSH port is on a different port, say 2222 instead of 22 then simply add the port like so:

ssh-keygen -f ~/.ssh/known_hosts -R [somehostname.net]:2222
ssh-keygen -f ~/.ssh/known_hosts -R [123.123.123.123]:2222
Improve this answer
0

The reason for the warning has already been explained in other answers.

For "how to avoid it" here are my two cents:

The "feature" to warn about such changes is in my opinion mostly an annoying bug since so far I do not know of away to say "I know - leave me alone with that warning in the future".

The error message e.g. might also appear simply because you assign two different names to a host with the same IP address. Any time you start addressing it with a different name the error message will appear and you will be asked for an action. I'd love to see this changed so any comments are welcome on how to fix this. If there are positive comments this answer might well move to a separate question.

Improve this answer
1
  • If you have a system whose SSH key legitimately keeps changing, you might write a Host block for it in your ~/.ssh/config file, with settings StrictHostKeyChecking no and UserKnownHostsFile /dev/null. But that means you can then be trivially Man-in-the-Middle attacked when connecting to that particular host, so consider carefully where to use this.
    – telcoM
    Jun 28, 2018 at 14:33
0

If you have an error like this: 

Warning: the RSA host key for 'myVPS' differs from the key for the IP address 'xxx.xx.xxx.xx'
Offending key for IP in /home/manolo/.ssh/known_hosts:1
Matching host key in /home/manolo/.ssh/known_hosts:2
Are you sure you want to continue connecting (yes/no)?

just delete line 1 in your known_hosts file. Then next time you run the git commant it will add the hew RSA host hey.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .