DEV Community

Big Mazzy
Big Mazzy

Posted on

Fix SSH Remote Host Identification Has Changed on Ubuntu 24.04

#linux #ubuntu #tutorial #devops

TL;DR: Verify the rebuilt server’s ED25519 fingerprint on its console, remove the stale laptop entry for shop.example.com, and reconnect only if the fingerprints match.

The problem

After rebuilding a VM, you try to connect from your laptop and SSH stops with a host identification warning. The saved key for the server’s name no longer matches the key presented by the server:

@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!    @
Offending ED25519 key in /home/you/.ssh/known_hosts:3
Host key verification failed.
Enter fullscreen mode Exit fullscreen mode

This warning means SSH is protecting you from connecting to a host whose identity differs from the one recorded on your laptop. It can happen after a legitimate rebuild, but a changed key can also signal that you are reaching an unexpected server. Treat the warning as a reason to verify the server before reconnecting.

The example uses shop.example.com and the account ubuntu. The host name is a placeholder; use the name you actually connect to.

Why it happens

SSH servers have host keys that identify them to clients. When you connect, your laptop saves the server’s key in its known_hosts file. On a later connection, SSH checks that the key still matches.

Rebuilding the VM regenerates its server host keys. Your laptop still trusts the old key, so the new key triggers the warning. The safe fix is to compare the new key’s fingerprint using the VM console, then remove the old saved entry and reconnect. Keep host checking enabled: only accept the new key after confirming its fingerprint.

Step-by-step fix

  1. From the laptop, attempt the connection so you can see the warning and confirm which host is affected. The IP, PID, and session numbers shown in examples are placeholders; the known-hosts line number is also specific to that example. 
   ssh ubuntu@shop.example.com
Enter fullscreen mode Exit fullscreen mode
  1. Open the VM console through your provider. On the VM, go to the SSH configuration directory and print the fingerprint of its ED25519 public host key. Write down the fingerprint so you can compare it on the laptop. 
   cd /etc/ssh
Enter fullscreen mode Exit fullscreen mode 
   sudo ssh-keygen -lf ssh_host_ed25519_key.pub
Enter fullscreen mode Exit fullscreen mode

Example console output:

   256 SHA256:q7Lw2Hn9xR4tVb1ZkM8sPd0eYcA3uJfG6iOy5TnKlWo root@lab-01 (ED25519)
Enter fullscreen mode Exit fullscreen mode
  1. On the laptop, remove the old saved entry for the host name. This removes the stale key so SSH can save the verified replacement. 
   ssh-keygen -R shop.example.com
Enter fullscreen mode Exit fullscreen mode

Example output:

   # Host shop.example.com found: line 3
   /home/you/.ssh/known_hosts updated.
Enter fullscreen mode Exit fullscreen mode
  1. Reconnect from the laptop. At the prompt, compare the fingerprint shown by SSH with the one you wrote down from the VM console. Continue only if they match. 
   ssh ubuntu@shop.example.com
Enter fullscreen mode Exit fullscreen mode

Example fingerprint prompt:

   ED25519 key fingerprint is SHA256:q7Lw2Hn9xR4tVb1ZkM8sPd0eYcA3uJfG6iOy5TnKlWo.
   Are you sure you want to continue connecting (yes/no/[fingerprint])?
Enter fullscreen mode Exit fullscreen mode
  1. If the fingerprints match, accept the new key by entering: 
   yes
Enter fullscreen mode Exit fullscreen mode

SSH should add the verified key to the known-hosts list:

   Warning: Permanently added 'shop.example.com' (ED25519) to the list of known hosts.
Enter fullscreen mode Exit fullscreen mode

How to verify

After reconnecting, run hostname in the SSH session and check that it identifies the expected VM:

hostname
Enter fullscreen mode Exit fullscreen mode

Example output:

lab-01
Enter fullscreen mode Exit fullscreen mode

The matching console and laptop fingerprints confirm that the key was checked before it was accepted. Host checking stayed on, and SSH now trusts the rebuilt server’s key for this host name.

Common mistakes

Do not disable host key checking to get past the warning. That bypasses the identity check instead of resolving the mismatch. Do not accept a fingerprint just because the server was rebuilt; compare it with the value from the VM console first. If the fingerprints differ, stop and verify that you are connecting to the expected host.

If you want a clean Ubuntu box to practice on, PowerVPS is a reasonable choice: https://powervps.net/?from=32

Watch more fixes on Server Lab: https://www.youtube.com/channel/UCov7rfWAnS4c2wF5E9V1Yag

Top comments (0)