Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I built several virtual machines during the last few weeks. The problem is, the .ssh/known_hosts gives me the Man in the middle warning. This happens because another fingerprint is associated with the virtual machine IP.

In the .ssh/known_hosts file, however, I don't find the record related to the IP, only two bizarre, key-like strings and "ssh-rsa".

Does anyone have any ideas about how to remove the old key from known_hosts?

share|improve this question
The host name(s) are always the first word in the known_hosts file; the format is <hostname>,<hostname>,... ssh-rsa <key>. If you're seeing something like "fe80:4::203:98dc:aa31:b6d1", say, then that's just an IPv6 address. – Kevin Reid Feb 1 '11 at 14:03
The "bizarre, key-like strings" you refer to are the hashed hosts/ip addresses. This a security feature which helps stops an intruder from knowing which systems you have access to. If you see this then your ssh_config has HashKnownHosts yes set. – Deebster Jul 12 '14 at 15:03

8 Answers 8

up vote 48 down vote accepted
sed -i '6d' ~/.ssh/known_hosts

Will modify the file ~/.ssh/known_hosts:6 , removing the 6th line.

In my opinion, using ssh-keygen -R is a better solution for an openssh power user, while your regular Linux admin would do better to keep his/her sed skills fresh by using the above method.

share|improve this answer
I don't think it's a good advice to edit a configuration file manually if you have an official application for that. Taking risks doesn't make you a pro, finding the quickest and safest option does. It's like telling people to go ahead and edit /etc/sudoers without visudo. If you want to sharpen your sed skills, go ahead and do that without messing up your system. – kraxor Jun 27 '14 at 11:56

The simplest solution is:

rm -f .ssh/known_hosts

ssh will recreate the file again, but you lose key checking for other hosts!

Or, you can use:

ssh-keygen -R "hostname"

Or the ssh "man-in-the-middle" message should indicate which line of the known_hosts file has the offending fingerprint. Edit the file, jump to that line and delete it.

share|improve this answer
Correct - the line number is somewhat shy : "Add correct host key in /home/adam/.ssh/known_hosts to get rid of this message. Offending key in /home/udi/.ssh/known_hosts:48". Removed line 48 and it worked! – Adam Matan Aug 26 '09 at 16:17
ssh-keygen -R hostname will work too. – grawity Aug 26 '09 at 17:14
If we remove that file, other keys will remove too. – shgnInc May 4 '14 at 9:13
Removing the file is a bad advice, it's like telling someone to buy a new PC because the old one has a broken mouse. Manually editing a file that can be edited by an official application is also a bad idea. The ssh-keygen option was added because of a comment, but with no explanation. I don't think this answer deserves so many upvotes. – kraxor Jun 27 '14 at 11:52
-1 because of the whole "delete the whole known_hosts file" first lines. This is a terrible, terrible, terrible thing to propose, and should be edited out. – Olivier Dulac Mar 9 at 10:35

There is an ssh-keygen switch (-R) for this.

man ssh-keygen reads:

-R hostname Removes all keys belonging to hostname from a known_hosts file. This option is useful to delete hashed hosts (see the -H option above).

share|improve this answer
This is the easiest and safest method. – Leo Koppelkamm Apr 15 '14 at 14:13

The warning will tell you the exact line in the known hosts file.

Here's an example:

The RSA host key for has changed,
and the key for the corresponding IP address
is unchanged. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
Offending key for IP in /home/user/.ssh/known_hosts:6

See the /home/user/.ssh/known_hosts:6 part? It specifies the file and line number.

share|improve this answer
Thanks - 1 minute from being the first... – Adam Matan Aug 26 '09 at 16:26

You can also instruct ssh to not check the known_hosts file using the UserKnownHostsFile and StrictHostKeyChecking flags.

For instance:

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no

For ease of use you can alias this:

alias boldssh='ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'

Now you can just boldssh whenever you are sure you trust the server's certificate.

share|improve this answer
What a horrible idea. Permanently disable a layer of security just because you're too lazy keeping your ~/.ssh/known_hosts up-to-date? Why not just go ahead and use telnet? "whenever you are sure" - if you are ever sure, then you have no idea what a MITM attack is and you should probably spend some time reading some good literature. – kraxor Jun 27 '14 at 12:02
Based on the OP's question I think this is a valid answer. Sometimes you have a test system that you're creating/destroying a lot of VMs on. (I'm doing this right now as I prep for the RHCE exam.) There might not be any security implications. While noting the security implications is great, I don't think this has to be labeled a "horrible idea". – Rick Chatham Oct 1 at 19:54

You can also remove a single line from known hosts with e.g. rmknownhost 111 (111 is the line to remove):

#! /usr/bin/env ruby
line = ARGV[0] || raise("gimme line to remove")
hosts = File.expand_path("~/.ssh/known_hosts")
content = File.readlines(hosts)
removed = content.delete_at line.to_i - 1
puts "Removed:\n#{removed}", 'w'){|f| f.write content * ""}

Save this as rmknownhost in a folder from your PATH.

share|improve this answer
What's the benefit of this over doing it in any given text editor? Is there some reason not to do it that way, like how sudoers has to be edited with visudo? – Andy Lester Jun 22 '10 at 16:37
What distros come with this? Ubuntu doesn't seem to have it. – flickerfly Jul 19 '13 at 13:54
The benefit is that it's automated and quick / it's a separate binary you add yourself – grosser Jul 20 '13 at 15:17
You could have just posted your script here instead of linking your own blog entry that you created on the day you posted this answer. This qualifies as spam IMHO. Not to mention that you could create a simple alias to achieve the same result, no need for a 7 lines long ruby script. – kraxor Jun 27 '14 at 12:08

The entry for the host name or ip should be in the first column. The warning should also list a line number where the offending key lies.

share|improve this answer

It is a text file. You can easily edit with vi(m) and simply delete the line in question (dd), and save the file (wq). But if there is a specific command to remove a host, that's probably the safest method.

share|improve this answer
I don't see how editing the file directly in VIM is "unsafe". It's based on your comfort level with VIM. Especially with this file, the biggest risk you have is deleting too many keys, in which case you'll just get prompted again. – Rick Chatham Oct 1 at 19:56
The "safety" I was referring to involves 1) forgetting/not knowing to remove dependent info in other files (if any) and 2) Accidentally deleting more or less than needs to be, thus breaking the file. – Ryan Griggs Oct 2 at 18:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.