Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So... we need to upgrade the SSHD. How can we do this without having that issue that the people (who are signing in through ssh) would see the message:

Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
Please contact your system administrator.
Add correct host key in /home/USERNAME/.ssh/known_hosts to get rid of this message.
Offending key in /home/USERNAME/.ssh/known_hosts:13
RSA host key for []:22 has changed and you have requested strict checking.
Host key verification failed.
share|improve this question
up vote 5 down vote accepted

Just upgrading sshd typically won't replace the host key. So yes just upgrade it and it should be fine.

Note: You won't typically need this but if you want to be on the safe side you can create a backup of the ssh host keys and copy them back after you upgraded your system. Typically you would have to backup /etc/ssh/ssh_host*. If something went wrong you can restore the files later.

share|improve this answer

I realize this is an old question, but i think this is a valid addition for future searches. Upgrading your sshd should not cause the host key to be recreated, so you are fine with an upgrade. Upgrading your server however, may cause a new host key to be created. The message you are describing appears when the ssh client does not recognize the host key of the server, so anything that changes the host key will cause this problem.

One way around this is to remodel your ssh usage to use certificates instead of passwords and keys. While this does take some work, and a little remodeling, but it is worth it you want to better sign your servers. There is a very good guide here:


Basically, what you do is create a CA for the servers and a CA for the users, and then use those to authenticate the clients and servers respectively. You would still see the above message if you logged in with username/password, but for anyone logging in with certificates, the only thing that matters is that the server host certificate is signed by the server CA.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.