I have reinstalled the OS of my remote server, and now when I try to ssh root@myserverIP from my local machine I get:

Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
Please contact your system administrator.
Add correct host key in /var/root/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /var/root/.ssh/known_hosts:3
ECDSA host key for xxx.xxx.xxx.xxx has changed and you have requested strict checking.
Host key verification failed.

(xxx is just to hide the real info)

Instead of changing the key, I have opted for full deletion of all the content in .ssh/known_hosts, hoping to be prompted to add the key again. But instead, I still get the very same error.

So, I have even tried to remove the the single key manually:

ssh-keygen -R xxx.xxx.xxx.xxx

And, of course, it is not there since known_hosts is now empty:

Host xxx.xxx.xxx.xxx not found in /Users/xxx/.ssh/known_hosts

However, I am still getting the same error over and over. This is puzzling- where does ssh get the info from if known_hosts is blank?

Of course, I have restarted my Mac, and I have even flushed the cache. Maybe ssh is using another known_hosts? But where is it? I tried to locate it but I can't find any other known_hosts file in my drive.

What am I doing wrong? How can I solve this?


You have more than one known_hosts file

It seems from your description you removed the key from your known_hosts file:

Host xxx.xxx.xxx.xxx not found in /Users/xxx/.ssh/known_hosts

Where /Users/xxx/ is presumably your home directory. However, the original error message complains:

Offending ECDSA key in /var/root/.ssh/known_hosts:3

So, remove the key from /var/root/.ssh/known_hosts and the error message will disappear.

  • Why ssh-keygen -R xxx.xxx.xxx.xxx would not work then? I am not supposed to have access to /var/root/.ssh/known_hosts – alec_djinn Apr 29 '18 at 9:57
  • However, I have changed the permission and modified that file and now it is working. Thanks. Still puzzled about ssh-keygen -R xxx.xxx.xxx.xxx and by the fact that locate did not output /var/root/.ssh/known_hosts – alec_djinn Apr 29 '18 at 9:58
  • @alec_djinn Fair points! The locate question and how ssh-keygen -R works on macos might make for interesting follow-up questions. I don't know off the top of my head why they work (or didn't work!) in the way they do- but I'd certainly be interested to find out :) – bertieb Apr 29 '18 at 10:34
  • (I could make educated guesses for both, but definitive answers are always welcome!) – bertieb Apr 29 '18 at 10:39
  • @alec_djinn ssh-keygen -R only operates on the current user's known_hosts file (unless you specify a different one with -f). I assume you're running ssh as root (and that's why it's using /var/root/.ssh/known_hosts instead of your file)? No user other than root has access to the /var/root/.ssh directory. – Gordon Davisson May 1 '18 at 3:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.