Server Warnings

SSH Login

Remote Host Identification has changed

When logging in on a remote host.
PS C:\Users\Username> ssh remote_user@remote_host.tld
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:YTSl+awfF17/mCxc1SWqf3L5LTNB1vKA3453mzP34uU.
Please contact your system administrator.
Add correct host key in C:\\Users\\Username/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in C:\\Users\\Username/.ssh/known_hosts:7
ECDSA host key for [remote_host.tld]:PORT has changed and you have requested strict checking.
Host key verification failed.
PS C:\Users\Username>
Severity

The risks of an online intrusion are quite real here, and you need to make sure there is no MITMA (man-in-the-middle attack) going on against you.

Why does this warning come up?

The fingerprint sent by the remote host differs from the one in the known_hosts file on the local machine.

What could be the cause?

This warning could indicate that a malicious user is targeting your access (MITMA).

Other reasons could be these:

  • you change your password or SSH private key on the remote host or

  • set up your VPS host again and then started another with the previous IP or

  • several remote systems were given an identical IP address or

  • your OS was reinstalled or switched

If these changes are made, SSH will recognise a change in your connection.

What needs to be done?

If you are not sure and the error could be caused by a malicious user, change the connection to the remote host and check whether the warning is still present.

Only if you are 100% sure that there is no security risk to your connection and that the error was not caused by a malicious user, you can remove the key on the local computer that can no longer be used.