SSH host key seems to be changing unexpectedly

There are three common reasons you would be getting that message.
In rough order of probability they are:

  1. You have changed the host keys yourself, and didn't clear or update them on your client machines.
    This is the most common situation. Checksum the key files and be ABSOLUTELY CERTAIN they haven't changed.

  2. You have changed your SSH configuration to present (or request) a different key type than before.
    e.g. you previously wanted RSA or DSA keys, now you use ECDSA -- that's a "key change".
    If this is the case, verify and accept the new keys (or if this isn't what you wanted, undo the change).
    (It sounds like you're in situation #2 -- Undo your changes, restart sshd, and verify that things work as expected. If you haven't accepted the new keys anywhere undoing the change should make the error go away.)

  3. SOMEONE IS DOING SOMETHING NASTY
    The Man-in-the-Middle attack SSH warns you about has reared its ugly head. Someone is actively trying to intercept your communication to steal your private key or do something else you almost certainly don't want them to be doing.


If you've eliminated 1, and you are certain you didn't do 2, it behooves you to assume 3 until you can prove otherwise. That means Don't log in. -- All the SSH security in the world doesn't help when users ignore the big giant warning banner and hand their keys over to attackers.

Investigate the channel between you and your server, check the server's connection logs (from a known good terminal) while you try to log in, etc. -- there are so many ways to execute an attack here that I can't enumerate all the possible countermeasures and detection strategies, but the folks over at IT Security would surely have some ideas.