SSH known_hosts File
About Host Keys
SSH connections from a client to a server use a cryptographic key called a host key to verify that the machine on the other side of the connection is what it claims to be. When host keys are updated or changed, an ssh client will warn users that the host key is not what was expected (especially if the client is connecting to a machine they have connected to before). The warning might look something like this¹:
Offending ECDSA key in /userspace/bengineer/.ssh/known_hosts:5
Verifying the New Key
If this happens, it means something about the remote system has changed, and the user should verify that this change was expected before continuing to connect to that system.
Ideally, the administrators for that system will provide information about the updated host keys so that you can verify them. CAE does this for the systems that it manages, usually in the KB or via announcement on the CAE Website: https://www.cae.wisc.edu/.
In other situations, you may only get confirmation that the change was expected. While it isn't recommended to accept unverified keys, ensuring you are receiving them over a secure, trusted network connection² can help reduce the risk of compromise. Failing that, you can reach out to the administrator of a remote service to ask about unexpected changes to their host keys.
Removing Old Keys
Even when the change is expected and fully-verified, users will still need to remove old keys before they can accept the new one. Removing a host key from the file will mean that the client "forgets" about the host key, and will be prompted to accept the new key when they reconnect. There are a few ways to remove old SSH keys from a client. The following section shows examples which should work for the most commonly used client (i.e. OpenSSH).
Examples
Using command line utilities provided along with the SSH client
ssh-keygen -f ~/.ssh/known_hosts -R <hostname>
Where "<hostname>" is replaced with the name of the host whose keys have changed. Note that hostnames are interpreted literally. For example, linux-0123 and linux-0123.lab.cae.wisc.edu are two separate known_hosts entries, even if they have the same key.
Using generic command line utilities
sed -e '<N>d' ~/.ssh/known_hosts
Where "<N>" is replaced with the line number from the warning (e.g., "5" in the example message at the top of this page). A host with multiple keys or a saved IP address may require this command to be rerun for each time it appears in the file.
- The file name is only "known_hosts", the colon and number indicate the line in the file where the bad hostkey is located.
- The College of Engineering VPN is a good choice when connecting to a system located on an Engineering or UW network.