Known Hosts

Trust On First Use, formalized

~/.ssh/known_hosts stores fingerprints of every server you've connected to. The first time you connect, SSH asks you to verify the fingerprint and saves it. Every subsequent connection, SSH compares — if the fingerprint changes, you get a loud warning.

The scary banner — what it means

If a server's host key changes from what's in known_hosts, SSH refuses to connect and prints a screaming warning:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

Two possibilities:

Benign — the server was reinstalled, OS reimaged, or sshd reconfigured. The host key got regenerated.
Hostile — someone is intercepting your connection (man in the middle).

You have to know which. If you reinstalled — fine, remove the old fingerprint with ssh-keygen -R and accept the new one. If you didn't — stop, investigate.

Pre-populating known_hosts

For automation, you don't want the interactive prompt on first connection. ssh-keyscan grabs the fingerprint and you append it to known_hosts. Or set StrictHostKeyChecking accept-new (auto-accept new hosts but still warn on changes).

Code

Manage known_hosts·bash

# View entries (each line is hashed by default)
cat ~/.ssh/known_hosts | head

# Remove a specific host (after a legitimate reinstall)
ssh-keygen -R 192.168.1.100
ssh-keygen -R office.local

# Pre-populate without an interactive prompt
ssh-keyscan -H 192.168.1.100 >> ~/.ssh/known_hosts

# Show the server's fingerprint as if you were verifying it manually
ssh-keyscan 192.168.1.100 2>/dev/null | ssh-keygen -lf -

Exercise

Pick one host you SSH to often. Run ssh-keygen -F that-host to find its known_hosts entry. Then run ssh-keyscan that-host 2>/dev/null | ssh-keygen -lf - and verify the fingerprint matches what you have. This is what you'd do whenever the scary banner shows up — practice it once now while nothing's broken.