What the message looks like
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Host key verification failed.Common causes
- The server was reinstalled or its SSH keys were regenerated.
- The IP address or hostname now belongs to a different machine, for example after a cloud rebuild.
- A load balancer or a cluster hands out different servers with different keys.
- DNS points to a different host than before.
- Rarely: someone is intercepting the connection.
Check
- Which key is stored for this host?
ssh-keygen -F server.example.com - Fingerprint the server shows now
ssh-keyscan -t ed25519 server.example.com 2>/dev/null | ssh-keygen -lf - - Fingerprint on the server itself (use the console or a trusted channel)
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
Fix
- Compare the two fingerprints. If they match the new server you expect, continue.
- Remove only the old entry:
ssh-keygen -R server.example.com(and the IP address if it is listed too). - Connect again and accept the new key after checking its fingerprint.
- If the key changed and you did not expect it, do not connect. Ask the owner or use the provider's console.
- For rebuilt servers that should keep their identity, restore the old
/etc/ssh/ssh_host_*files from backup.
FAQ
Can I turn the warning off with StrictHostKeyChecking=no?
Technically yes, but it removes the protection against interception. Fix the entry instead, and never use that option permanently.
Why does it appear after every rebuild of my cloud server?
A new server generates new host keys. Automate the cleanup with ssh-keygen -R in your rebuild script, or keep and restore the host keys.