Description

This article explains how to correct the "Host key verification failed" error on EX/QFX Series switches, which is seen whenever the SSH key in the remote device has changed.

Symptoms

  • Your SSH session abnormally terminated.

    OR

  • After logging out, you are not able to log in to the EX switch again.

 

Output example when logged in to host using SSH with IP address 192.168.0.1

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
38:d3:21:8a:58:ab:ec:7d:97:a4:0c:ef:a2:1f:f4:9b.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending key in /root/.ssh/known_hosts:2
RSA host key for 192.168.0.1 has changed and you have requested strict checking.
Host key verification failed

Solution

The above error is seen when the SSH key in the remote device changes following a primary RE switchover. This is common.

 

To resolve the issue, delete the key from the local device as shown below.

  1. Use sed to delete the related line:

root@switch:RE:0% sed -i ' 2d ' ~/.ssh/known_hosts

Where 2d refers to the error in the output 'Offending key in /root/.ssh/known_hosts:2'

  1. Use the ssh-keygen command to delete by using the IP address:

root@switch:RE:0% ssh-keygen -R 192.168.0.1
/root/.ssh/known_hosts updated.
Original contents retained as /root/.ssh/known_hosts.old

Then SSH to the switch will be successful:

root@switch:RE:0% ssh 192.168.0.1

The authenticity of host '192.168.0.1 (192.168.0.1)' can't be established.
RSA key fingerprint is 38:d3:21:8a:58:ab:ec:7d:97:a4:0c:ef:a2:1f:f4:9b.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.0.1' (RSA) to the list of known hosts.
Password:
--- JUNOS 20.4R3-S3.4 built 2022-04-08 08:32:02 UTC

Modification History

2022-09-19: Updated article to use compliant IP addresses