I'm new to Linux. I have 2 Debian Squeeze hosts running. Let's call them SqueezeOne and SqueezeTwo. After logging into SqueezeOne, I ran ssh-keygen and added the resulting public key to my authorized key file:

cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

I also added a public key generated by puttygen from my Windows desktop to the same key file.

I can ssh in from my putty just fine without being asked for my password. However, if I type in either of the following commands:

ssh localhost 
ssh One

I get the following error.

The authenticity of host 'localhost (' can't be established.
RSA key fingerprint is 75:56:33:22:c3:da:43:72:11:33:ec:50:f4:d0:dd:c7.
Are you sure you want to continue connecting (yes/no)?
Host key verification failed.

If I go to SqueezeTwo, and try to ssh to SqueezeOne, I receive the same message. On SqueezeTwo, there is a ~/.ssh/known_host file, which I know did not create on my own. However, I am not seeing the same known_hosts file on SqueezeOne.

On SqueezeTwo, I can ssh to localhost and itself with no problem.

What am I doing wrong?

  • I would expect the host key for localhost ( to be different for each host. – jsbillings May 11 '12 at 17:48
  • 1
    obviously i'm a dumb a**. instead of typing yes, i hit enter, which defaults to no. when i type yes, an entry is automatically added to known_hosts. DUUUUUUUUUUUH!!!!!!!!!!! – Bajingan Keparat May 11 '12 at 19:02

Depending on what you are doing, it might be a good idea to not include localhost host key in ~/.ssh/known_hosts. This can be accomplished with the NoHostAuthenticationForLocalhost option, either used on the command line with -o NoHostAuthenticationForLocalhost or by inserting NoHostAuthenticationForLocalhost yes into ~/.ssh/config.

  • That option is meant for people who have shared home directories across multiple servers. – Patrick May 12 '12 at 16:26

A hostkey identifies the machine. The keys in your authorized_keys file identify you. You should always expect to be prompted to accept the hostkey once for each machine you connect to.

If you are ever re-prompted for a machine you've already accepted, it may indicate something as innocuous as re-installing the SSH package, or as sinister as a man-in-the-middle attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.