When I try to ssh (using ssh [email protected]) into my server at home from either the local network or from outside, I get the following error: enter image description here

But if I use sudo ssh [email protected], it works with no problems: enter image description here

I'm sure I just need to place some kind of key in that /Users/mattlove/.ssh/known_hosts directory, but I'm not sure how or why.

Any of you UNIX buffs out there have an answer?

E D I T :

Here are the results of running ls -l ~/.ssh/known_hosts as requested by @LoïcWolff

enter image description here

  • Good question :) I had this problem a while back. Nice machine name btw.
    – Robin
    Jan 24, 2012 at 21:23
  • @Robin I have an all Star Trek name theme in my house. Network name is The Alpha Quadrant, server is DS9, iPhone is communicator, AirPort Express is wormhole. It's pretty awesome. :)
    – Matt Love
    Jan 24, 2012 at 22:03
  • @MattLove I've been racking my brains for months for a theme for my machine names, haven't been able to settle on one yet :(
    – Robin
    Jan 24, 2012 at 22:07

2 Answers 2


The first time you connect to a server, you are prompted to accept the fingerprint for the host you are connecting to. The fingerprint is a combination of a digital signature, the host name and the IP address of the server. When you do accept, the fingerprint is saved in ~/.ssh/known_hosts as being a "trusted" host.

For some reason, the server's fingerprint has changed since the first time you connected to it. This may be because it is not the server you expect it to be, for example when your request is being intercepted and redirected to a different server. Hence the security warning. The explanation might also be less malicious, for example when the server was replaced/reinstalled without restoring it's previous digital signature, or when the IP address has changed.

If despite the security warning, you still trust the server you are connecting to, you should open ~/.ssh/known_hosts and look for the line starting with the address of the server you are connecting to. Remove the entire line and save your changes, then reconnect to the server. The first time you connect, it should again prompt you to accept the updated fingerprint, after which you should have no more troubles connecting to that host.

The reason why it would work with sudo is because in those conditions you are running it as a different user (root), and each user has it's own known_hosts file (for root this is located at /private/var/root/.ssh/known_hosts). root may have never recorded the previous fingerprint of that host, and therefor has no way of comparing it to the current one, and no reason to distrust the server.

  • You are a master sir. I actually just dragged the known_hosts file to the Desktop and reconnected with no issues. I did recently downgrade my server from Lion Server to Snow Leopard Server so that's probably how it happened. Thanks!
    – Matt Love
    Jan 19, 2012 at 14:38

The known_hosts file contains the keys from hosts which you have previously connected to, and have verified that you have checked the key signature is correct.

In your case, one of two things has happened,

  1. The key on the server has changed since you approved it for your account, but not since it was approved for the root account.
  2. There is an attacker intercepting communications between you and the server, and you have approved their key for the root account and have the correct key in your account.

Most likely is case 1 - man-in-the-middle attacks on SSH, while possible, are relatively rare. The warning is there to alert you to the fact that someone may be intercepting you communications, even though the chances of this are quite low.

To resolve this, open the known_hosts file and remove the entry for the host in question. Contact the System Administrator for the host and ask them for the 'Host Key Fingerprint'. Make your connection again, verify that the fingerprint matches the one you get from the System Administrator and approve the key.

If the fingerprint does not match the one supplied by the System Administrator of the remote host, DO NOT approve the key!!

  • Thanks. @Gerry beat you to the punch, but I ended up dragging the known_hosts file to the Desktop and reconnected with no issues. I did recently downgrade my server from Lion Server to Snow Leopard Server so that's probably how it happened. Thanks!
    – Matt Love
    Jan 19, 2012 at 14:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .