SSH: '@@@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @@@ ... Host key verification failed.' Is it an attack, and how do I fix it safely?

Cause: the first time you connect to a host, SSH stores its host key in ~/.ssh/known_hosts. This warning means the server now presents a different key for the same name or IP. Usually it's harmless: the server was rebuilt or reinstalled, a cloud VM or container got a new key, an IP or DNS name was reused for another machine, or the service rotated its keys (GitHub replaced its RSA host key in March 2023, for example). It can also mean someone is intercepting the connection, which is exactly what the warning protects against, so don't simply bypass it. Fix: 1. Confirm the new key out-of-band before trusting it: ask the server's admin, check the provider's published fingerprints (for GitHub, its documented SSH key fingerprints page), or read the key from the server console (ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub on the server). 2. Remove the old entry: ssh-keygen -R hostname (and ssh-keygen -R <ip> if it was stored by IP, or ssh-keygen -R '[host]:port' for a non-standard port). The warning message also names the offending line in known_hosts. 3. Connect again and compare the fingerprint SSH shows with the one you verified before typing yes. 4. For services that publish their keys, add them directly (for GitHub, from its documented key list) instead of trusting on first use, which is also how to fix CI runners. 5. Don't use StrictHostKeyChecking=no or UserKnownHostsFile=/dev/null as a permanent fix in scripts or CI; it disables the protection entirely. For machines that are rebuilt often, use SSH certificates (a host CA) or a managed known_hosts file instead. Verify: the connection works without the warning, and the fingerprint matches the one published by the server owner. Sources: https://man.openbsd.org/ssh-keygen https://man.openbsd.org/ssh_config https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints