How to Fix “host key verification failed” in SSH

by

When connecting to a remote server using SSH, security and trust are paramount. One of the key safeguards in this process is the verification of host keys, ensuring that the server you’re connecting to is indeed the one you expect. However, users sometimes encounter the dreaded error: “host key verification failed.” This issue prevents the SSH connection from being established and can cause significant disruption in automation, scripting, and everyday system access tasks.

This article will explore what the error truly means, the reasons behind it, and most importantly, how to resolve it in a safe and effective way. Understanding this error helps maintain secure communication practices while also facilitating reliable connections.

Contents

What Is “Host Key Verification Failed”?

When you use SSH to connect to a remote server for the first time, the server provides its public host key. SSH then prompts you with a message asking if you trust the host. If you say yes, SSH stores the key in a file called known_hosts located in your home directory, specifically at ~/.ssh/known_hosts. This file is used to verify the server’s identity in the future. If the server’s key doesn’t match the one stored, SSH terminates the connection with the following message:

host key verification failed

This mechanism is a form of man-in-the-middle (MITM) attack prevention. If host keys were to silently change without verification, you could be tricked into connecting to an altered or rogue server.

Common Causes of the Error

  • Server Reinstallation or Host Key Regeneration: If the remote server was recently rebuilt or its SSH keys were reset, the stored key will no longer match.
  • Connecting to a Different Server at the Same IP or Hostname: Dynamic IPs or DNS changes can point hostnames to new servers, again causing a mismatch in keys.
  • Corrupted or Malformed Known Hosts File: Errors in the structure or permissions of the known_hosts file can result in verification failures.
  • Security Tools Modifying SSH Behavior: Some endpoint protection tools or firewalls interfere with key exchanges and SSH behavior.

How to Diagnose the Problem

Before attempting a fix, you should confirm what’s causing the error. To debug SSH connection issues with more detail, run:

ssh -v user@hostname

Focus on lines that mention host key mismatches or verification failures. Reading this output allows you to pinpoint the discrepancy source and determine if it’s a trust issue, configuration error, or system change.

Solutions to Fix “Host Key Verification Failed”

Here are several methods to resolve this issue. It’s important to note that you should not simply remove or replace the key without verifying that the new key is legitimate. Doing so may open the door to man-in-the-middle attacks.

1. Manually Remove the Offending Key

If you are confident that the host has legitimately changed—say the server was rebuilt by a trusted admin—then you can safely remove the old key and allow SSH to store the new one.

ssh-keygen -R <hostname or IP>

For example:

ssh-keygen -R 192.168.1.20

This command removes the matching line from your ~/.ssh/known_hosts file for the specified host.

2. Use ssh-copy-id (For Authentication Issues)

If host verification is coupled with authentication problems, and you trust the server, use ssh-copy-id to install your public key to the remote host. This will also create the correct host key entry post-authentication.

ssh-copy-id user@hostname

3. Manually Check and Compare Host Keys

Before accepting new host keys, you should compare them with trusted sources—such as server logs, a verified system admin, or a company-issued documentation.

ssh-keyscan -H hostname

This command fetches the host public key without adding it to known_hosts. You can compare this with an authoritative source. Once verified, optionally append it manually to known_hosts.

4. Edit the known_hosts File Directly

Another approach is editing ~/.ssh/known_hosts and removing the problematic line manually. Each line represents one host key. Using a text editor, find and delete or replace the offending entry. You can find the line number from verbose SSH command output:

Offending ECDSA key in /home/user/.ssh/known_hosts:5

Remove line 5 using:

sed -i '5d' ~/.ssh/known_hosts

5. Temporarily Bypass Host Verification

Warning: This method disables all SSH host verification and should only be used for throwaway connections where security is not a concern. Never use this in production environments.

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null user@hostname

This will skip verification entirely and not record the key for future verification. Use only when doing quick tests or in secure, isolated environments.

Preventing Future Issues

Proactive strategies help minimize the recurrence of host verification failures:

  • Centralized Host Key Management: Use automation tools like Ansible or configuration management suites to maintain known host keys in a consistent manner across environments.
  • DNS + SSHFP Records: SSHFP records in DNS allow clients to verify keys without storing them in known_hosts. This improves key management when hosts have dynamic IPs.
  • Use Host Aliases: Instead of referencing servers by IP, use aliases and update them centrally. This reduces the likelihood of replacing one key with another unintentionally.

When to Be Cautious

If you receive this error unexpectedly and cannot explain the reason, do not blindly override or delete known hosts entries. This might be evidence of a man-in-the-middle attack.

Contact your system administrator or hosting provider to confirm the change in the host key before replacing it. Always prioritize secure practices over convenience.

Conclusion

While “host key verification failed” may feel like a frustrating blockage, it serves a vital role in maintaining secure communication across networks. It signals that something has changed and prompts the user to verify the change before proceeding—a critical defense against impersonation and eavesdropping.

By understanding the root causes and appropriate solutions, administrators and users can resolve this error effectively without compromising security. Whether you’re handling server upgrades, DNS migrations, or auditing infrastructure, managing SSH host keys responsibly should be at the core of your operations.

Always double-check before replacing any known host keys, and when in doubt, escalate to a trusted authority within your organization. Vigilance is the cornerstone of cybersecurity.