On my mac I've 1 entry per server in the ~/.ssh/known_hosts file, in Ubuntu I noticed there are two created per server. Why is that?

Format is:

|1|wwwwwwwwwwwwwww=|wwwwwwwwww= ecdsa-sha2-nistp256 AAAAAAAAAA+AAAAA=
|1|vvvvvvvvvvvvvvv=|vvvvvvvvvv= ecdsa-sha2-nistp256 AAAAAAAAAA+AAAAA=

In both entries, first section before ecdsa-sha2-nistp256 is different. After ecdsa-sha2-nistp256 it is same (pub key I imagine).

I ssh into server A, and from there I ssh into server B. I'm not manually adding entries, I see ubuntu warning and allow it to add to known_hosts file.

I blanked known_hosts file for this test.

I've a reasonable doubt that extra entry is for ipv6 address, even though I've not used it to connect. Does ubuntu add it automatically if available?

  • How are you adding entries to the file? Do you maybe log into the server with multiple users? Please edit your question and include the specific commands used to create the entries.
    – terdon
    Commented Apr 12, 2014 at 14:05
  • @terdon I'm not adding entries manually. I simply ssh into server, and check the warning and accept it.
    – user25389
    Commented Apr 12, 2014 at 14:09
  • If I understand the ssh manpage, section "SSH_KNOWN_HOSTS FILE FORMAT" right, the first value is the hashed hostname... but thats confusing even more, since they shouldn't have the same pub key.
    – PythoNic
    Commented Apr 12, 2014 at 14:27
  • @PythoNic I read that too, and got more confused. But, I'm testing ssh from remote server. So basically I ssh into server A, and I ssh from there to server B. Could that be the cause? Or could it be ipv6 entry? I'm really confused.
    – user25389
    Commented Apr 12, 2014 at 14:30

2 Answers 2


You have two entries because one is by domain and the other by IP address, so your example:

|1|wwwwwwwwwwwwwww=|wwwwwwwwww= ecdsa-sha2-nistp256 AAAAAAAAAA+AAAAA=
|1|vvvvvvvvvvvvvvv=|vvvvvvvvvv= ecdsa-sha2-nistp256 AAAAAAAAAA+AAAAA=

might in effect read:

[example.com] ecdsa-sha2-nistp256 AAAAAAAAAA+AAAAA=
[] ecdsa-sha2-nistp256 AAAAAAAAAA+AAAAA=

If you disable known host hashing (add HashKnownHosts no to your ~/.ssh/config file) then you can see what is happening, but on a non-hashed known_host file, both the domain and IP address can appear on the same line, so they'd look like this:

[example.com],[] ecdsa-sha2-nistp256 AAAAAAAAAA+AAAAA=

There's a bit more of a discussion of the known_hosts file format here.


You should have one key for each server you have connected to. Either you have connected to two servers at various times or the key on your single server was changed.

When you first connect to a ssh server you are asked if you wish to add the key to known hosts.

Looks something like this :

enter image description here

So you accepted the keys with your client at some point in time.

With each subsequent connection, when you connect to the server the keys are compared and you get a warning if they are changed.

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA host key has just been changed. The fingerprint for the RSA key sent by the remote host is f2:92:1d:da:81:2a:d7:16:0a:48:f0:43:20:1c:f4:b5. Please contact your system administrator. Add correct host key in /home/bodhi/.ssh/known_hosts to get rid of this message. Offending key in /home/bodhi/.ssh/known_hosts:1

See: http://bodhizazen.com/Tutorials/SSH_overview#Security

  • 2
    I've removed known_hosts file. I ssh into server. I see the warning and allow it to add entry to known_hosts. It creates two entries.
    – user25389
    Commented Apr 12, 2014 at 14:10
  • Pastebin you known-hosts file and take a screen shot or show your output.
    – Panther
    Commented Apr 12, 2014 at 14:58
  • See also unix.stackexchange.com/questions/45140/…
    – Panther
    Commented Apr 12, 2014 at 17:04
  • Could it be ipv6 address?
    – user25389
    Commented Apr 13, 2014 at 7:05
  • I can not tell from what little you have posted.
    – Panther
    Commented Apr 13, 2014 at 13:39

You must log in to answer this question.