mjhjmtu

ssh -p yyyy root@xxxxxxxxx
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Offending ECDSA key in /home/debian8/.ssh/known_hosts:28
 remove with: ssh-keygen -f "/home/user/.ssh/known_hosts" -R [xxxx]:yyyy
ECDSA host key for [xxxxxxxx]:yyyy has changed and you have requested strict checking.
Host key verification failed.

Doing as warning say.

$ ssh-keygen -f "/home/user/.ssh/known_hosts" -R [xxxx]:yyyy

/home/user/.ssh/known_hosts is not a valid known_hosts file. 
Not replacing existing known_hosts file because of errors 

Which command to execute now?

If you are sure that only the key is incorrect and you choose to remove it.

List of alternative solutions:

1.- Execute the recommended command.

The command to be executed is right there in the error message:

$ ssh-keygen -f "/home/user/.ssh/known_hosts" -R [xxxx]:yyyy

replace

• 
  xxxx by hostname or IP used in connection with ssh


• 
  yyyy by port number (if non standard)

That will remove the failing key, then just re-connect to get the new key in the file.

2.- Remove line 28 of file

The error also state that the failing line is:

Offending ECDSA key in /home/debian8/.ssh/known_hosts:28

The line numbered 28, which could be removed with a text editor, or with:

sed -i '28d' "/home/user/.ssh/known_hosts"

then reconnect to get the correct key.

3.- Move the file.

Move the file to a backup (for future reference/use/extraction of keys)

mv /home/user/.ssh/known_hosts /home/user/.ssh/known_hosts_backup

let ssh rebuild the file as each new host is contacted.

4.- Erase the whole file

If all the above fails, erase the whole file

rm "/home/user/.ssh/known_hosts"

it will be rebuilt for each new host you re-connect to.

The error message "/home/user/.ssh/known_hosts is not a valid known_hosts file." shows the problem. ssh-keygen is unable to parse the file because it has been corrupted—most likely by incorrect manual editing.

If you don't have a recent backup, the easiest solution would be to move the corrupted known_hosts aside and allow ssh to generate a new one. You will have to re-accept keys for any remote hosts which you had previously accepted.

$ mv /home/user/.ssh/known_hosts /home/user/.ssh/known_hosts.old

Do you use host name hashing? If not, you can use a text editor to remove the matching line in /home/user/.ssh/known_hosts starting with the hostname. It should look a bit like this:

hostname-or-ip ecdsa-sha2-nistp256 AAAA...

(for other interested readers, the ecdsa-bit could also be ssh-rsa, but here, it's explicitly complaining about a ECDSA key.)

The SSH warning means that remote host xxxxxxxxx's public key has changed. This is either due to the remote host's administrator having changed the public key, or to an intruder performing a man-in-the-middle attack between your machine and the remote host.

If you are absolutely sure it's the former case, remove the cached invalid key from .ssh/known_hosts by editing the file and removing the line starting with the remote host name.