How to fix Offending RSA key in /home/user/.ssh/known_hosts:line in SSH

SSHBEGINNERMEDIUMUpdated Jan 4, 2026· 423 views

This warning appears when SSH detects that a remote server's host key has changed since you last connected to it. The offending key is stored in your known_hosts file, and SSH refuses to connect until you remove or update the old key entry.

Quick fix

Fixes Offending RSA key in /home/user/.ssh/known_hosts:line

ssh-keygen -R hostname.example.com
  1. Verify the server change is legitimate
  2. Remove the offending key using ssh-keygen
  3. Manually remove the specific line (if ssh-keygen doesn't work)
  4. Attempt to reconnect to the server
ssh — error
ssh-keygen -R hostname.example.com
Offending RSA key in /home/user/.ssh/known_hosts:line

What this error means

SSH maintains a file (~/.ssh/known_hosts) that stores the public host keys of servers you've connected to. This prevents man-in-the-middle attacks by verifying that the server you're connecting to is the same one you previously trusted. When the warning "Offending RSA key in known_hosts" appears, it means the server's current host key doesn't match what's stored in your known_hosts file. This typically happens because the server was reinstalled, SSH was upgraded on the server, the host key was manually regenerated, or you're connecting to a different server on the same IP address. SSH refuses to connect automatically and requires you to remove the old key before proceeding.

Typical symptoms

  • SSH connection is refused with a 'REMOTE HOST IDENTIFICATION HAS CHANGED!' warning
  • Error message shows 'Offending RSA key in /path/to/.ssh/known_hosts:N' (where N is a line number)
  • The same hostname or IP worked fine before but now fails
  • Connecting to a newly rebuilt or reinstalled server fails verification
  • SSH prompts to accept the new host key but shows the offending key error first

Common causes

  1. The remote server was reinstalled or recreated, generating a new host key
  2. SSH server was upgraded or reinstalled on the remote host
  3. The remote server's host key was manually regenerated or rotated
  4. You're connecting to a different server that now has the same IP or hostname
  5. The known_hosts file was corrupted or manually edited incorrectly
  6. DNS or network configuration changed, pointing the hostname to a different server

How to fix "Offending RSA key in /home/user/.ssh/known_hosts:line"

1Verify the server change is legitimate

Before removing any keys, confirm that the server actually changed. Contact your system administrator or check your deployment logs if you deployed a new server instance. This prevents accepting keys from a compromised server during a man-in-the-middle attack.

If you just rebuilt the server yourself, this is expected behavior and safe to proceed.

2Remove the offending key using ssh-keygen

Use the ssh-keygen -R command to automatically remove the old key from your known_hosts file:

bash
ssh-keygen -R hostname.example.com

Or if using an IP address:

bash
ssh-keygen -R 192.168.1.100

The removed key is automatically backed up to ~/.ssh/known_hosts.old for safety. This command removes all entries for that hostname or IP from known_hosts.

3Manually remove the specific line (if ssh-keygen doesn't work)

If you prefer to manually edit the file, open it with your editor:

bash
nano ~/.ssh/known_hosts

Find the line number mentioned in the error message and delete it. For example, if the error says "line 15", delete line 15. Save and exit.

Alternatively, use sed to remove a specific line number (replace 15 with your line number):

bash
sed -i '15d' ~/.ssh/known_hosts
4Attempt to reconnect to the server

Try connecting again using SSH:

bash
ssh user@hostname.example.com

SSH will now ask you to verify and accept the new host key. Carefully examine the fingerprint shown and confirm it matches what you expect (consult your server provider or administrator if unsure). Type 'yes' to accept and add the new key to known_hosts.

The output will show:

bash
The authenticity of host 'hostname.example.com' can't be established.
ED25519 key fingerprint is SHA256:...
Are you sure you want to continue connecting (yes/no/[fingerprint])?
5Verify the new key is stored correctly

After accepting the new key, confirm it's in your known_hosts file:

bash
cat ~/.ssh/known_hosts | grep hostname.example.com

You should see one line with the new key. If you see multiple entries for the same host, use ssh-keygen -R again and reconnect to clean it up.

You can also inspect the key fingerprint at any time with:

bash
ssh-keygen -l -f ~/.ssh/known_hosts -F hostname.example.com

Advanced notes

Advanced troubleshooting:

Clearing all known_hosts: If you have many servers and want to start fresh, you can remove the entire file (not recommended for production):

bash
rm ~/.ssh/known_hosts

You'll be prompted to accept keys for each server on next connection.

Automated deployment scenarios: In CI/CD pipelines or scripts, use the -o StrictHostKeyChecking=accept-new option to automatically accept new keys without user interaction:

bash
ssh -o StrictHostKeyChecking=accept-new user@hostname.example.com

This is safe only if you control the server and network.

Finding multiple entries for the same host: Sometimes known_hosts contains both hostname and IP entries for the same server. Remove both:

bash
ssh-keygen -R hostname.example.com
ssh-keygen -R 192.168.1.100

SSH key algorithms: Older SSH servers may use RSA-only keys, while newer systems prefer ED25519 or ECDSA. If connecting to legacy systems, make sure your SSH client supports RSA keys (some newer systems disabled RSA by default).

Frequently asked questions

What does "Offending RSA key in /home/user/.ssh/known_hosts:line" mean?
ssh/known_hosts) that stores the public host keys of servers you've connected to. This prevents man-in-the-middle attacks by verifying that the server you're connecting to is the same one you previously trusted. When the warning "Offending RSA key in known_hosts" appears, it means the server's current host key doesn't match what's stored in your known_hosts file.
How do I fix "Offending RSA key in /home/user/.ssh/known_hosts:line"?
This warning appears when SSH detects that a remote server's host key has changed since you last connected to it. The offending key is stored in your known_hosts file, and SSH refuses to connect until you remove or update the old key entry.
What causes "Offending RSA key in /home/user/.ssh/known_hosts:line"?
The remote server was reinstalled or recreated, generating a new host key SSH server was upgraded or reinstalled on the remote host The remote server's host key was manually regenerated or rotated
Is the "Offending RSA key in /home/user/.ssh/known_hosts:line" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading