Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have built several virtual machines during the last few weeks. The problem is, the .ssh/known_hosts gives me the Man in the middle warning. This happens because another fingerprint is associated with the virtual machine IP.

In the .ssh/known_hosts file, however, I don't seem to find the record related to the IP, only two bizarre, key-like strings and "ssh-rsa".

Any ideas how to remove the old key from known_hosts?

Thanks,

Udi

share|improve this question
    
The host name(s) are always the first word in the known_hosts file; the format is <hostname>,<hostname>,... ssh-rsa <key>. If you're seeing something like "fe80:4::203:98dc:aa31:b6d1", say, then that's just an IPv6 address. –  Kevin Reid Feb 1 '11 at 14:03
add comment

7 Answers

up vote 30 down vote accepted
sed -i '6d' ~/.ssh/known_hosts

Will modify the file ~/.ssh/known_hosts:6 , removing the 6th line.

In my opinion, using ssh-keygen -R is a better solution for an openssh power user, while your regular Linux admin would do better to keep his/her sed skills fresh by using the above method.

share|improve this answer
add comment

You can also instruct ssh to not check the known_hosts file using the UserKnownHostsFile and StrictHostKeyChecking flags.

For instance:

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no [email protected]

For ease of use you can alias this:

alias boldssh='ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'

Now you can just boldssh whenever you are sure you trust the server's certificate.

share|improve this answer
add comment

You can also remove a single line from known hosts with e.g. rmknownhost 111 (111 is the line to remove)

share|improve this answer
    
What's the benefit of this over doing it in any given text editor? Is there some reason not to do it that way, like how sudoers has to be edited with visudo? –  Andy Lester Jun 22 '10 at 16:37
    
What distros come with this? Ubuntu doesn't seem to have it. –  flickerfly Jul 19 '13 at 13:54
    
The benefit is that it's automated and quick / it's a separate binary you add yourself –  grosser Jul 20 '13 at 15:17
add comment

There is an ssh-keygen switch (-R) for this.

man ssh-keygen reads:

-R hostname Removes all keys belonging to hostname from a known_hosts file. This option is useful to delete hashed hosts (see the -H option above).

share|improve this answer
    
This is the easiest and safest method. –  Leo Koppelkamm Apr 15 at 14:13
add comment
  • Simplest solution: rm -f .ssh/known_hosts (ssh will recreate file again - but you lose key checking for other hosts!)
  • use ssh-keygen -R "hostname"
  • ssh man-in-the-middle message should indicate which line # of the known_hosts file has the offending fingerprint. Edit the file, jump to that line # and delete it
share|improve this answer
    
Correct - the line number is somewhat shy : "Add correct host key in /home/adam/.ssh/known_hosts to get rid of this message. Offending key in /home/udi/.ssh/known_hosts:48". Removed line 48 and it worked! –  Adam Matan Aug 26 '09 at 16:17
19  
ssh-keygen -R hostname will work too. –  grawity Aug 26 '09 at 17:14
    
Thanks for mentioning ssh-keygen -R. I just wanted to remove a host from known_hosts for testing purposes (i.e. without that the host key changed) and this hosts entry was hashed... –  Andre Holzner May 4 '11 at 9:21
add comment

The warning will tell you the exact line in the known hosts file.

Here's an example:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for foo-bar.net has changed,
and the key for the corresponding IP address 127.0.0.1
is unchanged. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
Offending key for IP in /home/user/.ssh/known_hosts:6
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

See the /home/user/.ssh/known_hosts:6 part? It specifies the file and line number.

share|improve this answer
    
Thanks - 1 minute from being the first... –  Adam Matan Aug 26 '09 at 16:26
add comment

The entry for the host name or ip should be in the first column. The warning should also list a line number where the offending key lies.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.