I have a Google cloud server that currently runs Ubuntu 16.04. I have not done much to it in years and it always ran great.

Somehow or other, for the first time, it experienced downtime today of about 15 minutes.

After I restarted it, ssh gives me a warning "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!". I am certain that I, the sole administrator, did not initiate any such changes. Last time I logged in, was yesterday.

While I can, obviously, change the known hosts file and adjust to the new host key, I am extremely disturbed by this change and I am suspecting that something is amiss. Would anyone have any clue as to why this count happen?

I did log on to it from a google cloud ssh window and, on the first look, it runs as usual running my website. However, right now I am overwhelmed with paranoia and what it could be.



Managing SSH keys changing has been a consideration for about as long as SSH has been around. Here's one of several Server Fault questions on the topic: SSH host key seems to be changing unexpectedly. In short, the key changed, configuration changed, or someone is doing something nasty.

Look through logs and your backups. Compare the keys before to the key now, including if the key type changed. Check if any SSH packages were upgraded on the server or client. Look for log file entries such as cloud-init which may have rekeyed if VM identification changed.

A cautious option is to rebuild a clean OS image, with new keys and credentials. Only restore the application data from backups. This work may be overkill. However, it also can be a useful business continuity exercise to prove you can abandon the instance but keep your data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.