server.example.test was legitimately rebuilt and its host key changed; the fingerprint was verified through another channel.
Remove only the old host entry from ~/.ssh/known_hosts.
Which command is appropriate?
ssh-keygen -R HOST removes plain or hashed entries for the specified host from known_hosts. Verify a legitimate key change before removing warnings.
Detailed explanation
ssh-keygen -F server.example.testIncorrect. -F searches for a matching entry but does not remove it.
Incorrect. -F searches for a matching entry but does not remove it.
ssh-keygen -l server.example.testIncorrect. -l displays key fingerprints and is not the known_hosts removal operation.
Incorrect. -l displays key fingerprints and is not the known_hosts removal operation.
ssh-keygen -D server.example.testIncorrect. -D relates to PKCS#11 provider keys, not a host entry.
Incorrect. -D relates to PKCS#11 provider keys, not a host entry.
ssh-keygen -R server.example.testCorrect. It removes the specified host's known_hosts entries.
Correct. It removes the specified host's known_hosts entries.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s
' '-F=find host entries' '-R=remove host entries' '-l=show key fingerprint'Expected result
-F=find host entries
-R=remove host entries
-l=show key fingerprintKey points
- -R means remove
- Verify the change first
- Do not delete the whole file
Notes
- Environment: OpenSSH ssh-keygen option対応表
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.