Easily Remove Stale Entries from ~/.ssh/known_hosts When a Host Rebuilds with ssh-keygen ‑R

Wed, 14 Oct 2026 10:00:02 +0200

When a host rebuilds, its SSH key changes

A fresh install or a system rebuild swaps the host’s RSA/ED25519 key pair.
If you still have the old key in ~/.ssh/known_hosts, the next SSH connection will trigger a “WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!” message.
That warning is a safety feature, but it also blocks automation and forces users to manually edit the file.

The quickest, safest way to clean up stale entries is to let OpenSSH do the work with ssh-keygen -R. The command removes every key that matches the supplied hostname or IP, regardless of whether the entry is hashed or plain.

Automation on Linux Security

Easily Remove Stale Entries from ~/.ssh/known_hosts When a Host Rebuilds with ssh-keygen ‑R

When a host rebuilds, its SSH key changes

Easily Remove Stale Entries from ~/.ssh/known_hosts When a Host Rebuilds with ssh-keygen ‑R