Fixing SSH Error: Host Key Verification Failed After VPS Re-installation

by

Root Cause Diagnosis

This error occurs because SSH records the unique cryptographic host key fingerprint of remote servers in your local ~/.ssh/known_hosts file upon first connection. Re-installing the OS on your VPS generates a new pair of host keys while keeping the same IP address or domain name. SSH detects this fingerprint mismatch and halts the connection attempt to prevent potential Man-In-The-Middle (MITM) attacks.

Quick Fix

Purge the outdated host key entry for the remote server IP or hostname from your local SSH registry using ssh-keygen:

# Remove the old host key for the specified IP or domain
ssh-keygen -R 192.168.1.100

(Replace 192.168.1.100 with your actual VPS IP address or hostname.)

Step-by-Step Resolution

Step 1: Identify the Stale Host Key Line

Attempt the SSH connection to pinpoint the exact line causing the conflict in your local file:

ssh root@192.168.1.100

SSH will display an error message specifying the file path and line number, for example: Offending ECDSA key in /home/user/.ssh/known_hosts:14

Step 2: Remove the Offending Key Entry

Choose one of the following methods to clear the key record:

  • Option A: Automated Removal (Recommended) “`bash ssh-keygen -R 192.168.1.100


* **Option B: Manual Removal**
Open **`~/.ssh/known_hosts`** in a text editor and delete the specific line number indicated in the error output (e.g., line 14):
```bash
nano ~/.ssh/known_hosts

Step 3: Accept and Store the New Host Key

Re-establish the SSH connection to fetch the new host fingerprint generated by the freshly installed VPS OS:

ssh root@192.168.1.100

When prompted: Are you sure you want to continue connecting (yes/no/[fingerprint])? Type yes and press Enter. SSH updates your ~/.ssh/known_hosts file with the new key.

See also  Fixing apt-get update Hash Sum Mismatch error on Ubuntu archive mirrors

Why This Fails for Some Users

  • Hashed known_hosts Entries: If HashKnownHosts yes is enabled in your ~/.ssh/config, hostnames in ~/.ssh/known_hosts are obfuscated (e.g., |1|a1b2c3...). Manually searching the file for an IP address will yield no matches, making ssh-keygen -R <IP> the only valid removal method.
  • Global/System-wide Known Hosts: Non-privileged user accounts may be affected by keys recorded globally in /etc/ssh/ssh_known_hosts. Running ssh-keygen -R on a local user account will not clear system-wide keys; root access (sudo) is required to modify /etc/ssh/ssh_known_hosts.
  • Multiple Entries (Domain vs. IP vs. Port): Removing an IP address record (ssh-keygen -R 192.168.1.100) does not clear the record saved for a domain name (ssh-keygen -R example.com) or custom SSH ports (ssh-keygen -R "[192.168.1.100]:2222"). Each alias must be cleared separately if configured.
  • Automated/CI-CD Environments: Non-interactive scripts (e.g., Ansible, Jenkins, GitHub Actions) fail automatically because they cannot accept the interactive fingerprint prompt. In automated environments, bypass strict checking by setting -o StrictHostKeyChecking=accept-new or -o StrictHostKeyChecking=no.

Leave a Comment