How to Fix the Host Key Has Changed Error in SSH

Imagine having a special key that unlocks the door to a remote computer, known as a server. This "key" is an SSH key, used to securely connect to that server over the internet. Your computer keeps a list of these keys in a secure file. However, sometimes you may encounter an error stating, "Host key has changed". Here's a straightforward guide to understanding and fixing this issue.

What Does "Host Key Has Changed" Mean?

When you connect to a server for the first time, your computer saves a "fingerprint" of the server’s key. This fingerprint acts like a unique identifier for the server. On subsequent connections, your computer checks if the fingerprint matches the saved one. If it doesn’t, you’ll see the Host key has changed error.

Think of it as having a photo of a friend’s house. If the house suddenly looks different when you visit again, you’d be confused. Similarly, this error means your computer is saying, “This doesn’t look like the server I remember!”

Why Does This Happen?

Several reasons could cause the server’s fingerprint to change:

1. The Server Was Rebuilt:
   If the server’s software was reinstalled or the server hardware was replaced, it generates a new key, leading to a new fingerprint. This is the most common reason.
2. Man-in-the-Middle Attack (Rare):
   In rare cases, someone may be attempting to intercept your connection and pretend to be the server. This is a serious security threat and should be ruled out by verifying with the server administrator.
3. Server Address Change:
   If the server has moved to a new IP address or hostname, its key might also change.

Where Does My Computer Store These Keys?

Your computer keeps fingerprints of previously connected servers in the known_hosts file, located in the .ssh directory:

• Mac/Linux:
  The file path is usually:
  /Users/YourName/.ssh/known_hosts (Mac) or /home/YourName/.ssh/known_hosts (Linux).
  The .ssh folder is hidden, so you may need to enable "show hidden files" in your file manager.
• Windows:
  If you use OpenSSH on Windows, the file is typically located at:
  C:\Users\YourName\.ssh\known_hosts.

How to Fix the "Host Key Has Changed" Error

Before proceeding, confirm with the server administrator that the key change is legitimate. This ensures you’re not connecting to a compromised or malicious server.

Steps to Fix the Error

1. Open a Terminal or Command Prompt:
   This is where you’ll execute the commands to fix the issue.
2. Remove the Old Host Key:
   Use the ssh-keygen command to delete the old key for the server. Replace <server's address> with the server’s hostname (e.g., example.com) or IP address (e.g., 192.168.1.100):

   ssh-keygen -R <server's address>

   For example:

   ssh-keygen -R example.com
   ssh-keygen -R 192.168.1.100

   This removes the old fingerprint from the known_hosts file.
3. Reconnect to the Server:
   Attempt to connect to the server again using your usual SSH command:

   ssh user@<server's address>

4. Accept the New Fingerprint:
   When prompted about the new fingerprint, confirm its authenticity. If you trust the server or have verified with the admin, type yes and press Enter.

Example Walkthrough

Imagine you’re trying to connect to a server at 192.168.1.100 and encounter the Host key has changed error. Here’s how to resolve it:

1. Open your terminal.
2. Type the following command and press Enter:

   ssh-keygen -R 192.168.1.100

3. Reconnect using your SSH command:

   ssh user@192.168.1.100

4. When asked about the new key fingerprint, type yes and press Enter.