How to fix Offending ECDSA key in /home/user/.ssh/known_hosts:line in SSH

SSHBEGINNERMEDIUMUpdated May 27, 2026· 282 views

This warning appears when SSH detects that a remote server's host key has changed. It prevents connections as a security measure to detect potential man-in-the-middle attacks or legitimate server reinstallations. The fix involves removing the old key from your local known_hosts file.

Quick fix

Fixes Offending ECDSA key in /home/user/.ssh/known_hosts:line

ssh-keygen -R hostname_or_ip
  1. Use ssh-keygen to remove the offending key (recommended)
  2. Manually edit known_hosts if you need to keep other entries
  3. Use sed to delete a specific line (advanced)
  4. Reconnect and verify the new host key
ssh — error
ssh-keygen -R hostname_or_ip
Offending ECDSA key in /home/user/.ssh/known_hosts:line

What this error means

When you connect to an SSH server, your local SSH client stores the server's public host key in the ~/.ssh/known_hosts file for future reference. If the server's key changes (because it was reinstalled, the host key was regenerated, or you're connecting to a different server on the same IP), SSH will refuse to connect and warn you that the "REMOTE HOST IDENTIFICATION HAS CHANGED". This is a security feature designed to protect you from man-in-the-middle attacks. The "Offending ECDSA key" message specifically identifies that the host key mismatch involves an ECDSA (Elliptic Curve Digital Signature Algorithm) key, and tells you the exact line number in your known_hosts file where the outdated key is stored.

Typical symptoms

  • SSH connection fails with warning about remote host identification changing
  • Error message includes the line number in ~/.ssh/known_hosts (e.g., :47)
  • Key type is specified as ECDSA in the error message
  • Connection is blocked completely—SSH refuses to proceed
  • The issue started after a server was reinstalled, rebooted, or rebuilt
  • Multiple stored keys for the same hostname show warnings

Common causes

  1. The remote server was reinstalled or reset, generating new SSH host keys
  2. The server's SSH configuration was reset or host keys were regenerated
  3. You are connecting to a different server that now uses the same IP address or hostname
  4. The server was moved to new infrastructure with different host keys
  5. A firewall or proxy is intercepting the connection (rare, but a security concern)
  6. Your known_hosts file contains both the hostname and its IP address as separate entries, and only one has changed

How to fix "Offending ECDSA key in /home/user/.ssh/known_hosts:line"

1Use ssh-keygen to remove the offending key (recommended)

The safest and most direct method is to use ssh-keygen with the -R flag, which removes all keys belonging to a specific hostname or IP address:

bash
ssh-keygen -R hostname_or_ip

Replace hostname_or_ip with the actual hostname or IP shown in the error. For example:

bash
ssh-keygen -R 192.168.1.100

Or with a hostname:

bash
ssh-keygen -R example.com

This will output something like:

bash
# Host 192.168.1.100 found: line 3
/home/user/.ssh/known_hosts updated.
Original contents retained as /home/user/.ssh/known_hosts.old

The command creates a backup (.old file) before removing the key, so you can restore it if needed. This is the cleanest approach because it removes all entries for that host, preventing duplicate warnings.

2Manually edit known_hosts if you need to keep other entries

If you want to manually remove only the specific line mentioned in the error:

1. Open the known_hosts file in your editor:

bash
nano ~/.ssh/known_hosts

2. Find and delete the line number shown in the error message (e.g., if the error says "line 47", delete line 47)

3. Save and exit (Ctrl+X, then Y, then Enter in nano)

Then try connecting again:

bash
ssh user@hostname

SSH will prompt you to verify the new host key fingerprint. If you trust the server, type yes to add the new key to known_hosts.

3Use sed to delete a specific line (advanced)

If you're comfortable with command-line tools, you can use sed to remove a specific line by number. Replace 47 with the actual line number from your error:

bash
sed -i '47d' ~/.ssh/known_hosts

The -i flag tells sed to edit the file in place. This is useful for scripting or one-liners.

Warning: Make sure you get the line number correct. If unsure, use the manual edit method or ssh-keygen instead.

4Reconnect and verify the new host key

After removing the offending key, attempt to reconnect to the server:

bash
ssh user@hostname

SSH will show you the server's new host key fingerprint and ask if you trust it:

bash
The authenticity of host 'example.com (192.168.1.100)' can't be established.
ECDSA key fingerprint is SHA256:abc123...
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Type yes to add the new key to your known_hosts file. If you can verify the fingerprint against a trusted source (e.g., your server admin), that's even better—it ensures you're not being man-in-the-middle attacked.

After this, the connection should proceed normally and future connections to this host will not warn you.

5Troubleshoot if the issue persists

If you still get the warning after removing the key:

1. Check if you have both hostname AND IP address entries in known_hosts that conflict:

bash
grep -n 'example.com|192.168.1.100' ~/.ssh/known_hosts

If both appear, remove both and reconnect. SSH may store entries for both the hostname and its IP separately, and they can have different keys if the server was rebuilt.

2. Verify the server's fingerprint matches what you expect:

bash
ssh-keyscan -t ecdsa example.com | ssh-keygen -l -f -

This shows the current key fingerprint on the server without connecting.

3. If you suspect a legitimate change (e.g., you just rebuilt the server), verify by contacting your server admin or checking your infrastructure management console to confirm the host keys were intentionally regenerated.

Advanced notes

Security Note: The "Remote Host Identification Has Changed" warning is a genuine security feature designed to protect you from man-in-the-middle attacks. Always verify that the host key change is legitimate before proceeding. If you didn't rebuild or reconfigure the server, and you weren't expecting a key change, investigate further—it could indicate an actual security issue on your network.

Hashed Entries: Modern SSH stores known_hosts with hashed hostnames for privacy. If your known_hosts file contains hashed entries (lines starting with "|1|"), ssh-keygen -R still works—it will find and remove the matching hash.

Docker and CI/CD Pipelines: In containerized environments or CI/CD pipelines, this error is common when containers are rebuilt frequently. A common pattern is to add StrictHostKeyChecking=no to skip this check (less secure) or to manage a shared known_hosts file that includes pre-trusted keys.

Debugging: To see which keys are causing the issue, use:

bash
ssh-keyscan -t ecdsa,rsa,ed25519 hostname 2>/dev/null | ssh-keygen -l -f -

This shows the current server keys without connecting, helping you verify if a key change is expected.

Frequently asked questions

What does "Offending ECDSA key in /home/user/.ssh/known_hosts:line" mean?
ssh/known_hosts file for future reference. If the server's key changes (because it was reinstalled, the host key was regenerated, or you're connecting to a different server on the same IP), SSH will refuse to connect and warn you that the "REMOTE HOST IDENTIFICATION HAS CHANGED". This is a security feature designed to protect you from man-in-the-middle attacks.
How do I fix "Offending ECDSA key in /home/user/.ssh/known_hosts:line"?
This warning appears when SSH detects that a remote server's host key has changed. It prevents connections as a security measure to detect potential man-in-the-middle attacks or legitimate server reinstallations. The fix involves removing the old key from your local known_hosts file.
What causes "Offending ECDSA key in /home/user/.ssh/known_hosts:line"?
The remote server was reinstalled or reset, generating new SSH host keys The server's SSH configuration was reset or host keys were regenerated You are connecting to a different server that now uses the same IP address or hostname
Is the "Offending ECDSA key in /home/user/.ssh/known_hosts:line" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading