When you are trying to connect to a QFX5100 device from an EX Series device, you may encounter the "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" error and consequently be unable to ssh to this device.
This article explains why this error occurs and how you can resolve it.
User is unable to ssh from one Juniper device (for example EX4300) to another device (QFX5100) due to the "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" error:
EX4300------------------QFX5100 root@EX4300> ssh [email protected] @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the ECDSA key sent by the remote host is SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Please contact your system administrator. Add correct host key in /var/home/root/.ssh/known_hosts to get rid of this message. Offending ECDSA key in /var/home/root/.ssh/known_hosts:13 ECDSA host key for 10.1.1.1 has changed and you have requested strict checking. Host key verification failed.
EX4300------------------QFX5100
root@EX4300> ssh [email protected] @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the ECDSA key sent by the remote host is SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Please contact your system administrator. Add correct host key in /var/home/root/.ssh/known_hosts to get rid of this message. Offending ECDSA key in /var/home/root/.ssh/known_hosts:13 ECDSA host key for 10.1.1.1 has changed and you have requested strict checking. Host key verification failed.
The "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" message will appear when you are trying to connect to the QFX5100 device from an EX4300 device, for example, and the QFX5100 public key is not recognized or is different from what is stored in your local known_hosts file. This is a Linux/Unix security measure to prevent a "man-in-the middle" attack and can occur in any Linux/Unix-based system.
You can resolve this error by updating the known_hosts file on the EX4300 with the correct key for the QFX device.
There are two workarounds to remove this from known_hosts:
ssh-keygen -f /var/home/root/.ssh/known_hosts -R "10.1.1.1"
Open the known_hosts file and either remove the entry for the 10.1.1.1 or update it with the proper public key.
For example:
{master:0} root@EX4300> start shell % cat /var/home/root/.ssh/known_hosts | grep 10.1.1.1 10.1.1.1 ecdsa-sha2-nistp256 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx % ssh-keygen -f /var/home/root/.ssh/known_hosts -R "10.1.1.1" # Host 10.1.1.1 found: line 13 /var/home/root/.ssh/known_hosts updated. Original contents retained as /var/home/root/.ssh/known_hosts.old % % cli {master:0} root@EX4300> ssh [email protected] The authenticity of host '10.1.1.1 (10.1.1.1)' can't be established. ECDSA key fingerprint is SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '10.1.1.1' (ECDSA) to the list of known hosts. Password: QFX5100@:RE:0% cli {master:0} QFX5100> show version localre: -------------------------------------------------------------------------- Model: qfx5100-48s-6q Junos: 20.2R2.11 JUNOS py-extensions2-i386 [20.2R2.11] JUNOS py-extensions-i386 [20.2R2.11]
To remove the entry for 10.1.1.1, you can use a vi editor and open a file at the specific line number.
For example, to go to line number 13:
root@EX4300> start shell % vi +13 /var/home/root/.ssh/known_hosts
Type 'dd' to delete the entire line, and then press ':wq' to save and quit.
2026-02-09: Minor, non-technical changes made for search optimization
2023-08-23: Initial Draft