SSH 連線失敗「WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED」解決方案

錯誤訊息完整內容

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@       WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!       @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
08:70:a2:d1:8c:a8:e2:a3:75:27:b5:90:ce:54:5b:3d.
Please contact your system administrator.
Add correct host key in /Users/henry/.ssh/known_hosts to get rid of this message.
Offending key in /Users/henry/.ssh/known_hosts:2
RSA host key for 66.105.230.188 has changed and you have requested strict checking.
Host key verification failed.

根因

• 目標伺服器重裝 OS / 重新產生 SSH Host Key
• IP 變更指向新主機
• 中間人攻擊 (極少見，但須警惕)

標準解決：移除舊金鑰記錄

方法一：ssh-keygen 指令 (最快、最乾淨)

ssh-keygen -R 66.105.230.188
# 輸出：/Users/henry/.ssh/known_hosts updated.
# Original contents retained as /Users/henry/.ssh/known_hosts.old

方法二：手動編輯 known_hosts

vi ~/.ssh/known_hosts
# 找到第 2 行 (Offending key:2) 或包含 66.105.230.188 的行
# 刪除該行 (dd)
# 存檔離開

方法三：sed 一鍵刪除

sed -i '/66.105.230.188/d' ~/.ssh/known_hosts

重新連線驗證

ssh root@66.105.230.188
# 首次會提示新金鑰指紋確認
The authenticity of host '66.105.230.188' can't be established.
RSA key fingerprint is SHA256:xxx.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
# 輸入 yes，寫入新金鑰

進階：嚴格模式 vs 寬鬆模式

# 臨時跳過檢查 (僅信任網路環境使用)
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@host

# 永久配置 ~/.ssh/config
Host *
    StrictHostKeyChecking ask
    UserKnownHostsFile ~/.ssh/known_hosts

最佳實踐

1. 伺服器重裝前：**通知所有連線使用者**預期會出現此警告
2. 使用 ssh-keyscan 預先收集金鑰分發給團隊：
   ssh-keyscan -t rsa,ecdsa,ed25519 66.105.230.188 >> known_hosts
3. 啟用 UpdateHostKeys yes (OpenSSH 6.8+) 自動更新輪換金鑰
4. 生產環境建議部署 SSH 憑證授權 (CA)，避免分散式 known_hosts 管理

Windows PuTTY 使用者

PuTTY 會彈出視窗提示金鑰變更，點選「是」更新快取即可。或在 Registry 清除：
HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\SshHostKeys