Remove key from known_hosts

Question

I have built several virtual machines during the last few weeks. The problem is, the .ssh/known_hosts gives me the Man in the middle warning. This happens because another fingerprint is associated with the virtual machine IP.

In the .ssh/known_hosts file, however, I don't seem to find the record related to the IP, only two bizarre, key-like strings and "ssh-rsa".

Any ideas how to remove the old key from known_hosts?

Thanks,

Udi

Answer 1

sed -i '6d' ~/.ssh/known_hosts

Will modify the file ~/.ssh/known_hosts:6 , removing the 6th line.

IMO, using ssh_keygen -R is a better solution for an openssh power user, while your regular linux admin would do better to keep his/her sed skills fresh by using the above method.

Answer 2

• Simplest solution: rm -f .ssh/known_hosts (ssh will recreate file again - but you lose key checking for other hosts!)
• use ssh-keygen -R "hostname"
• ssh man-in-the-middle message should indicate which line # of the known_hosts file has the offending fingerprint. Edit the file, jump to that line # and delete it

Answer 3

The warning will tell you the exact line in the known hosts file.

Here's an example:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for foo-bar.net has changed,
and the key for the corresponding IP address 127.0.0.1
is unchanged. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
Offending key for IP in /home/user/.ssh/known_hosts:6
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

See the /home/user/.ssh/known_hosts:6 part? It specifies the file and line number.

Answer 4

This is a response to Andy's comment stamped 'Jun 22 at 16:37':

visudo is important because it allows you to safely edit the sudoers file - if you make a mistake when editing that file manually, you (and your users) could be in for a world of hurt.

The rmknownhost script is just some admin's personal shortcut, written in his language of choice (ruby). Personally I prefer sed -i '6d' :keeping your sed/awk/grep skills from getting rusty is a good practice for a linux admin.

MODS: b/c this was already answered, I could not add a comment; I thought it was important to answer Andy's comment/ Sry.

Answer 5

The entry for the host name or ip should be in the first column. The warning should also list a line number where the offending key lies.

Answer 6

You can also remove a single line from known hosts with e.g. rmknownhost 111 (111 is the line to remove)