Host key verification failed protects you from connecting to an unexpected machine. The host key may have changed because a GPU server was rebuilt or moved, but it can also indicate DNS manipulation, a wrong address, or interception.

Do not respond with StrictHostKeyChecking=no or by deleting all of known_hosts.

Verify the change out of band

Obtain the expected fingerprint from a trusted source: cloud console metadata, provisioning output, an administrator through a separate channel, or the server console.

On the server:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Compare it with the fingerprint reported by the client. Confirm hostname, IP, environment, and bastion path.

Remove only the stale entry

After verifying the replacement:

ssh-keygen -F gpu.example.com
ssh-keygen -R gpu.example.com

Reconnect and compare the presented fingerprint before accepting it. Hashed known_hosts entries are handled by ssh-keygen; avoid manual broad deletion.

If an IP address or nonstandard port is used, remove the exact form stored by SSH. A bastion and destination each have independent host identities.

CI/CD must pin trust

Automated deployments cannot rely on an interactive “yes.” Provision a verified known-host entry through the deployment system and review host-key changes like credential changes.

Good controls include:

• host keys published by trusted infrastructure provisioning;
• separate known-host sets per environment;
• immutable runner images or protected CI variables;
• change approval for production fingerprints;
• logs that identify which host key was used;
• rotation with a documented overlap/migration plan.

ssh-keyscan retrieves a key but does not authenticate it. It is useful only when its output is compared against a trusted fingerprint.

Rebuilds and autoscaling

Frequently rebuilt AI hosts need stable identity management. Options include host certificates signed by an SSH CA, managed session services, or provisioning that securely publishes new fingerprints. Reusing a hostname without updating trusted identity is an operational design problem, not a reason to disable checking.

For unreachable hosts, see SSH timeouts on GPU servers. The foundation is How SSH works.

Connect host identity to the AI Security hub, deployment credentials to environment and secret management, and deployment controls to AI Deployment & Hosting.

A verified new host key restores trust. A bypass merely removes the warning.