How to fix IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! in SSH

SSHINTERMEDIATEHIGHUpdated Jan 4, 2026· 352 views

SSH shows this warning when the remote host's key fingerprint has changed or doesn't match your stored record. This is a critical security alert that requires verification before proceeding, as it could indicate a man-in-the-middle attack or a legitimate server change.

Quick fix

Fixes IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub
  1. Stop and verify the server change is legitimate
  2. Verify the new host key fingerprint
  3. Remove the old host key from known_hosts
  4. Reconnect to accept the new key
ssh — error
ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!

What this error means

When you connect to an SSH server, your client stores the server's unique cryptographic host key (fingerprint) locally in the known_hosts file. This fingerprint acts as a digital signature to verify you're connecting to the same trusted server every time. When SSH detects that the server's presented key doesn't match the stored fingerprint, it halts the connection and displays this warning. This mechanism exists to protect you from man-in-the-middle (MITM) attacks, where an attacker positioned between you and the legitimate server could intercept your connection, present their own fake SSH key, and capture your credentials or sensitive data. The warning means SSH detected an unexpected change and is refusing to proceed automatically.

Typical symptoms

  • SSH connection is blocked with a MITM warning message
  • You cannot connect to a previously accessible server
  • The warning mentions a host key mismatch or changed identification
  • You're using public Wi-Fi or an untrusted network

Common causes

  1. Server operating system was reinstalled (most common legitimate cause)
  2. Cloud provider replaced the server instance with a new one but kept the same IP or hostname
  3. Server administrator manually regenerated SSH host keys
  4. IP address was reassigned to a different server in a cloud environment
  5. Attacker intercepting your connection and presenting a fake SSH server (actual MITM attack)

How to fix "IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!"

1Stop and verify the server change is legitimate

Before removing any keys, determine whether the host key change is expected. Check your hosting provider's dashboard, contact your server administrator, or review recent maintenance notifications. Do NOT proceed if you cannot verify the legitimacy of this change, as doing so could expose you to a man-in-the-middle attack.

On your server's hosting console, look for information about server reinstalls, OS updates, or key rotations that would explain the key change.

2Verify the new host key fingerprint

If you have access to the server through another method (console, admin panel, phone call to administrator), verify the new host key fingerprint matches what you're about to accept.

On the target server, run:

bash
ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub

Or for RSA keys:

bash
ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub

Compare the fingerprint output with what your SSH client is showing. They must match exactly.

3Remove the old host key from known_hosts

Once you've verified the server change is legitimate, remove the outdated host key entry:

bash
ssh-keygen -R hostname_or_ip_address

Replace hostname_or_ip_address with your actual server's hostname or IP. For example:

bash
ssh-keygen -R example.com
ssh-keygen -R 192.168.1.100

If you're using both hostname and IP, run the command twice:

bash
ssh-keygen -R example.com
ssh-keygen -R 192.168.1.100

This command removes only the entries matching that host, leaving other known_hosts entries intact.

4Reconnect to accept the new key

Now attempt to reconnect to the server:

bash
ssh user@hostname_or_ip

SSH will prompt you to confirm the new host key fingerprint:

bash
The authenticity of host 'example.com (192.168.1.100)' can't be established.
ED25519 key fingerprint is SHA256:xxxxx...
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Type yes to accept the new key and store it in known_hosts. You should now be connected successfully.

Advanced notes

For cloud environments: Cloud providers frequently reuse IP addresses. If you're connecting to a previously used IP that's now assigned to a different server, you'll encounter this warning. Always verify you're connecting to the correct instance.

StrictHostKeyChecking: Never permanently disable host key checking in production environments. Options like StrictHostKeyChecking=no bypass SSH's core security feature and should only be used in controlled, trusted scenarios. Disabling this is like removing half of SSH's protections.

Manual known_hosts editing: As an alternative to ssh-keygen, you can manually edit ~/.ssh/known_hosts with a text editor and delete the line containing the old key. However, ssh-keygen -R is safer as it removes only the specific host entry.

Multiple entries: If you have both hostname and IP address entries for the same server in known_hosts, you must remove both to avoid future warnings.

SSH key types: Different SSH implementations use different key types (ED25519, RSA, ECDSA). When the server regenerates keys, it may use a different type, which also triggers this warning.

Frequently asked questions

What does "IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!" mean?
When you connect to an SSH server, your client stores the server's unique cryptographic host key (fingerprint) locally in the known_hosts file. This fingerprint acts as a digital signature to verify you're connecting to the same trusted server every time. When SSH detects that the server's presented key doesn't match the stored fingerprint, it halts the connection and displays this warning.
How do I fix "IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!"?
SSH shows this warning when the remote host's key fingerprint has changed or doesn't match your stored record. This is a critical security alert that requires verification before proceeding, as it could indicate a man-in-the-middle attack or a legitimate server change.
What causes "IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!"?
Server operating system was reinstalled (most common legitimate cause) Cloud provider replaced the server instance with a new one but kept the same IP or hostname Server administrator manually regenerated SSH host keys
Is the "IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading