>

Remove a Host Key from known_hosts with ssh-keygen -R

Delete stale SSH host keys after a server reinstall or IP change, fixing the MITM-warning without breaking the rest of known_hosts.

Linuxsshknown_hostsssh-keygenLow risk
Run ssh-keygen -R example.com to remove all stored keys for that host; for a non-standard port use ssh-keygen -R "[example.com]:2222".

01Command

Command
$ ssh-keygen -R example.com
ssh-keygen -R "[example.com]:2222"   # non-default port

02What it does

After reinstalling a server, SSH refuses to connect with 'WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!' because the old key still sits in ~/.ssh/known_hosts. ssh-keygen -R removes the matching lines safely — it handles hashed hostnames and writes a backup file — where manual editing fails on hashed entries. The bracket-port syntax matters because SSH keys the entry as [host]:port for anything other than port 22.

03Risk

RiskLow risk
!Warning: Only run this when you know why the key changed (your reinstall, a documented migration). A genuinely unexpected key change can be a man-in-the-middle attack.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • ssh-keygen(1) — Linux manual page
    man7.org · technical · 2026-09-17
    Evidence: ssh-keygen man page: '-R hostname Removes all keys belonging to hostname from a known_hosts file' including hashed-hostname support.
  • Arch Wiki: OpenSSH
    Arch Linux · community · 2026-09-17
    Evidence: Documents the changed-host-key error after server reinstall and using ssh-keygen -R to fix it.

Last verified: 2026-09-17 · Category: Security & Privacy