ssh-keygen -R hostname: remove a host from known_hosts

ssh-keygen -R hostname deletes every key stored for hostname from ~/.ssh/known_hosts and keeps a copy of the old file as known_hosts.old. Use it after a server was reinstalled or got a new host key, when ssh refuses to connect with REMOTE HOST IDENTIFICATION HAS CHANGED. The host must be written as it is stored: hosts on a non-default port are [hostname]:port, and an IP address is a separate entry from the name. Add -f FILE to edit another known_hosts file.

Example

The example builds a known_hosts file with three entries and removes one of them; -f points ssh-keygen at that file instead of ~/.ssh/known_hosts:

ssh-keygen -q -t ed25519 -N '' -C one -f key1
ssh-keygen -q -t ed25519 -N '' -C two -f key2
{
  echo "server.test $(cut -d' ' -f1,2 key1.pub)"
  echo "[server.test]:2222 $(cut -d' ' -f1,2 key2.pub)"
  echo "other.test $(cut -d' ' -f1,2 key2.pub)"
} > known_hosts
ssh-keygen -R server.test -f known_hosts
cut -d' ' -f1 known_hosts
echo ===
ssh-keygen -R '[server.test]:2222' -f known_hosts
ssh-keygen -R missing.test -f known_hosts
cut -d' ' -f1 known_hosts
ls known_hosts*

# Host server.test found: line 1
known_hosts updated.
Original contents retained as known_hosts.old
[server.test]:2222
other.test
===
# Host [server.test]:2222 found: line 1
known_hosts updated.
Original contents retained as known_hosts.old
Host missing.test not found in known_hosts
other.test
known_hosts
known_hosts.old

-R server.test removed only the entry on port 22: the [server.test]:2222 line is a different host for ssh and needed its own command. For a host that is not in the file, ssh-keygen prints not found and leaves the file alone. Each change saves the previous version as known_hosts.old.

Forms of the host name

Hashed known_hosts files

Many systems set HashKnownHosts yes, so the file shows lines starting with |1| instead of host names. You cannot find such entries with grep, but ssh-keygen -R name and ssh-keygen -F name still work, because ssh-keygen hashes the name you give and compares. That is the main reason to use -R instead of editing the file by hand. If you do edit it, ssh reports the offending line number in the Offending ... key in ~/.ssh/known_hosts:3 message, and sed -i 3d ~/.ssh/known_hosts deletes that line.

After removing the key

Connect again. ssh shows the new key's fingerprint and asks Are you sure you want to continue connecting (yes/no/[fingerprint])?. Compare the fingerprint with the one the server administrator publishes (on the server, ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub prints it) before typing yes. To add a key without an interactive prompt, ssh-keyscan -t ed25519 host >> ~/.ssh/known_hosts fetches it, but that trusts whatever the network returns, so check it the same way.

FAQ