Warning remote host identification has changed ssh windows

A secure internet connection is not just the ideal — it’s essential. In fact, we’re going to go as far as saying it’s the number one priority for your website. The “Warning: Remote host identification has changed” error protects your connection from certain malicious attacks, although in some cases, you can inadvertently cause the error too.

The error is related to your Secure Shell (SSH) keys and the server “fingerprint” a client will check for. If Secure Shell thinks there’s an issue, it will block access to your server and throw an error. But you can fix this in a few steps.

Over the next few minutes, we’re going to show you how to fix the “Warning: Remote host identification has changed” error for both Windows and Mac. First, though, let’s give you some more details on the error message itself.

A secure internet connection is not just the ideal — it’s essential 💪 While it may be annoying, this error protects your connection from attacks. 🙅‍♀️ Learn more ⬇️Click to Tweet

What the “Warning: Remote Host Identification Has Changed” Error Is

One of the most secure ways to connect to a web server is to use SSH. It’s a command-line tool that lets you access an insecure network securely. Consider it like a “super-SFTP” type of setup, although it’s not a 1:1 comparison in practice.

You can access your site from almost anywhere you can use the internet, as long as you have the right login credentials. What’s more, most macOS and Linux machines have an SSH client built into the Operating System (OS). For Windows, you’ll use a dedicated interface (and we’ll talk about this in more detail later).

As for the “Warning: Remote host identification has changed” error, it relates to the security checks your client will do. An SSH connection uses dedicated “keys” — small files stored on your computer — as authentication. It’s sort of like a Secure Sockets Layers (SSL) handshake, and in fact, there are some high-level similarities between SSH and SSL.

One aspect the keys help with is to provide a permanent fingerprint of its host server. This will make sure the connection is accurate and that you’re not subject to a “machine-in-the-middle” attack.

If the client thinks those fingerprints differ from what it understands to be correct, you’ll get the “Warning: Remote host identification has changed” error at the point of login:

[user@hostname ~]$ ssh root@user

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

Someone could be eavesdropping on you right now (man-in-the-middle attack)!

It is also possible that a host key has just been changed.

The fingerprint for the RSA key sent by the remote host is

xx:xx:xx.

Please contact your system administrator.

Add correct host key in /home/hostname /.ssh/known_hosts to get rid of this message.

Offending RSA key in /var/lib/sss/pubconf/known_hosts:4

RSA host key for user has changed and you have requested strict checking.

Host key verification failed.

As errors go, this is detailed and clear — it tells you what’s happened, a potential reason for why, and how you might fix it.

However, there’s one aspect we can touch on a little further before showing you how to fix the “Warning: Remote host identification has changed” error.

How the known_hosts File Helps SSH Authentication

You’ll notice that the error message references a known_hosts file. The name should give you a clue as to what it contains, but for clarity, it’s a list of SSH remote hosts known to the computer. It’s used as a reference client file for the authentication process.

When you first connect to a server, you’ll often get a confirmation request through your interface, asking whether you want to connect. If so, this fingerprint will become part of your known_hosts file.

Of course, if the fingerprint differs from what is in the known_hosts file, this could indicate a malicious user is targeting you. In other cases, you may already know why there’s a difference, although it pays to be vigilant regardless.

How To Fix the “Warning: Remote Host Identification Has Changed” Error (on Windows and Mac)

You can work to fix the “Warning: Remote host identification has changed” error for both Windows and macOS. However, you have more flexibility for doing so on Mac.

We’ll cover lots of the ways you can make things right again, starting with Windows.

1. Windows

It’s important to note that Windows machines might not have a known_hosts file. However, if you use the OpenSSH client, there is a file. To find it, open the Windows search bar, and navigate to your user folder with the %USERPROFILE% command.

This will open the directory within the File Explorer. There will also be a .ssh folder within:

The file we want in this folder is known_hosts. You can open this with Notepad (or your favorite text editor). Inside will be a list of keys:

Here, you can delete the key that’s causing the problem, then resave the file.

Some users may prefer the PuTTY client. The keys sit in the Registry, although they perform the same purpose as OpenSSH.

You’ll want to open the Windows Registry Editor (otherwise known as “regedit”). You can do this in whatever way you’re comfortable, but the quickest way is to type the app’s name into Window’s search bar:

Here, look for the following destination within regedit:

HKEY_CURRENT_USER/Software/SimonTatham/PuTTY/SshHostKeys/

You’ll see a list of entries here relating to the saved connections on your computer. Your job is to delete whichever one is causing an issue:

Once you click on the Delete button, you’ll also need to confirm that you want to remove the key:

Clicking Yes here means the key will be gone for good, and you shouldn’t get the “Warning: Remote host identification has changed” error any longer.

2. Mac

The Mac has a couple of ways to fix the “Warning: Remote host identification has changed” error — either through a premium app such as SSH Config Editor or the Terminal. The results will be the same, so we advise you to choose whichever option is more comfortable (and budget-friendly).

Our preferred approach is to access the file within a Terminal window (or iTerm2 if you use that app), and also open it with a dedicated Nano or Vim editor. This is because it’s accessible to everyone and straightforward to use regardless of your experience level.

Here, we’re going to use Nano. First, open your Terminal using whatever process is most comfortable:

From here, run the nano ~/.ssh/known_hosts command in your window. This will open a new Nano instance and display the keys within your known_hosts file:

You should delete the key causing the “Warning: Remote host identification has changed” error, then save your changes.

You might also want to delete the entire known_hosts file, especially if you only use SSH for one or two sites. To do this, you can run rm .ssh/known_hosts in a Terminal window.

There’s one more method to alter the known_hosts file on Mac: using the ssh-keygen utility from the command line. This is great if you don’t want to dig into the file itself, or if you want to work with only one site or key.

To achieve this, open a Terminal window and run ssh-keygen, followed by your server hostname. For example:

ssh-keygen -R server.example.com

This won’t ask you if you want to delete the specified lines, so make sure you’re removing the right ones before proceeding:

Once this is done, you shouldn’t get the “Warning: Remote host identification has changed” error from there on out.

Ever seen this error? 😅 It’s not always a bad thing (it’s protecting your connection from malicious attacks!), but it can be accidentally caused by your own activity. 😬 Learn more in this guide ⬇️Click to Tweet

Summary

Web security isn’t just about installing plugins and creating a strong password. The connections you use to log into servers need your utmost attention. If you don’t want to be subject to a machine-in-the-middle attack, you’ll want to use SSH access when you log in.

However, the system works almost too well. You may get the “Warning: Remote host identification has changed” error for a few reasons, and some are innocent.

Regardless, you can fix the error in no time through a Command Prompt or Terminal, using just a handful of commands.

The problem is that you’ve previously accepted an SSH connection to a remote computer and that remote computer’s digital fingerprint or SHA256 hash key has changed since you last connected. Thus when you try to SSH again or use github to pull code, which also uses SSH, you get an error. Why? Because you’re using the same remote computer address as before but the remote computer is responding with a different fingerprint. Therefore, it’s possible that someone is spoofing the computer you previously connected to. This is a security issue.

If you’re 100% sure that the remote computer isn’t compromised, hacked, being spoofed, etc then all you need to do is delete the entry in your known_hosts file for the remote computer. That will solve the issue as there will no longer be a mismatch with SHA256 fingerprint IDs when connecting.

On Mac here’s what I did:

1) Find the line of output that reads RSA host key for servername:port has changed and you have requested strict checking. You’ll need both the servername and potentially port from that log output.

2) Back up the SSH known hosts file cp /Users/yourmacusername/.ssh/known_hosts /Users/yourmacusername/.ssh/known_hosts.bak

3) Find the line where the computer’s old fingerprint is stored and delete it. You can search for the specific offending remote computer fingerprint using the servername and port from step #1. nano /Users/yourmacusername/.ssh/known_hosts

4) CTRL-X to quit and choose Y to save changes

Now type ssh -p port servername and you will receive the original prompt you did when you first tried to SSH to that computer. You will then be given the option to save that remote computer’s updated SHA256 fingerprint to your known_hosts file. If you’re using SSH over port 22 then the -p argument is not necessary.

Any issues you can restore the original known_hosts file: cp /Users/yourmacusername/.ssh/known_hosts.bak /Users/yourmacusername/.ssh/known_hosts

Linux

• 03.04.2018
• 27 421
• 4
• 12.03.2019
• 27
• 27
• 0

• Содержание статьи
  • Описание ошибки
  • Причина возникновения ошибки
  • Как ее исправить
  • Комментарии к статье ( 4 шт )
  • Добавить комментарий

Данная ошибка может появляться при попытке подключения к другому компьютеру через ssh и sftp протоколы.

Описание ошибки

Полностью она выглядит так:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:5VLqurxCsGZoX78FWhcaEQkHwAtq+Xzp1tBfOxKQQzE.
Please contact your system administrator.
Add correct host key in /home/ajiekceu4/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /home/ajiekceu4/.ssh/known_hosts:5
remove with:
ssh-keygen -f «/home/ajiekceu4/.ssh/known_hosts» -R sysadmin.ru
ECDSA host key for sysadmin.ru has changed and you have requested strict checking.
Host key verification failed.

Причина возникновения ошибки

Как видно из описания, данная ошибка может появляться в том случае, когда на устройстве, к которому вы пытаетесь подключиться, изменился ключ и он не совпадает с тем ключом, который вы уже получали ранее, когда осуществляли подключение к этому устройству в предыдущие разы. Причины могут быть разные:

• Был изменен сертификат на устройстве и соответственно поменялся ECDSA ключ (из соображений безопасности, например);
• Переустановлена ОС на устройстве и соответственно изменился сертификат;
• Кто то пытается вас обмануть;

Как ее исправить

Если вы точно знаете, что сертификат на удаленном устройстве, к которому вы пытаетесь подключиться изменился и это не попытка вас обмануть со стороны заинтересованных лиц, то исправить эту ошибку очень просто. Необходимо просто удалить текущий ключ для данного домена (в нашем примере sysadmin.ru), сделать это можно командой, которая описана в самом тексте ошибки:

ssh-keygen -f "/home/ajiekceu4/.ssh/known_hosts" -R sysadmin.ru

В случае успеха, вывод команды должен быть примерно таким:

# Host sysadmin.ru found: line 10
/home/ajiekceu4/.ssh/known_hosts updated.
Original contents retained as /home/ajiekceu4/.ssh/known_hosts.old

После этого, необходимо еще раз попытаться подключиться к удаленному хосту и подтвердить установку нового ключа, написав «yes»

ssh root@sysadmin.ru
The authenticity of host 'sysadmin.ru (88.99.12.44)' can't be established.
ECDSA key fingerprint is SHA256:5VLaarxCsGZcv78FWphaEQkHwAtq+Zzp1tBfOXKQQzE.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'sysadmin.ru' (ECDSA) to the list of known hosts.

Posted:
13 Jun, 23

Updated:
29 Jun, 23


by Susith Nonis



4 Min