When your SSH connections start behaving strangely, you might see errors like:

bash
$ ssh user@server.example.com
/home/user/.ssh/known_hosts: line 15: invalid format

Or:

bash
$ ssh user@server.example.com
No RSA host key is known for server.example.com and you have requested strict checking.

Or SSH might simply hang or crash during host key verification. These issues often stem from a corrupted known_hosts file.

Understand Known Hosts File Format

The known_hosts file stores fingerprints of servers you've connected to. Each line follows a format:

bash
server.example.com,192.168.1.100 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ...

Or with hashed hostnames:

bash
|1|abc123...|def456...| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ...

Corruption can occur from: - Disk errors - Partial writes during crashes - Manual editing mistakes - Encoding issues - Concurrent access problems

Check Known Hosts File

View the file:

bash
cat ~/.ssh/known_hosts

Check for obvious issues: - Empty lines in wrong places - Truncated lines - Binary/garbage characters - Missing key types - Duplicate entries

Check the file size:

bash
ls -la ~/.ssh/known_hosts

If it's unusually large or zero bytes, it might be corrupted.

Validate Each Line

Check line count:

bash
wc -l ~/.ssh/known_hosts

Look for malformed lines:

bash
awk '{if(NF<3) print NR": "$0}' ~/.ssh/known_hosts

Lines with fewer than 3 fields are malformed.

Check for invalid key types:

bash
awk '{print $2}' ~/.ssh/known_hosts | sort | uniq -c

Should show recognized types like:

bash
10 ssh-rsa
   5 ssh-ed25519
   3 ecdsa-sha2-nistp256

Unknown types indicate corruption.

Fix Specific Malformed Lines

If you know the problematic line number:

bash
sed -n '15p' ~/.ssh/known_hosts

Remove it:

bash
sed -i '15d' ~/.ssh/known_hosts

Or fix manually if you know the correct format.

Remove Duplicate Entries

Find duplicates:

bash
sort ~/.ssh/known_hosts | uniq -d

Remove duplicates:

bash
sort -u ~/.ssh/known_hosts -o ~/.ssh/known_hosts

This sorts and deduplicates the file.

Backup and Recreate

If the file is severely corrupted, back it up and start fresh:

bash
cp ~/.ssh/known_hosts ~/.ssh/known_hosts.corrupted
rm ~/.ssh/known_hosts

Now reconnect to servers to rebuild the file:

bash
ssh user@server.example.com

You'll be prompted to accept new keys:

bash
The authenticity of host 'server.example.com' can't be established.
ED25519 key fingerprint is SHA256:abc123...
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Recover Known Hosts from Backup

If you have a backup:

bash
ls -la ~/.ssh/known_hosts.old

Restore it:

bash
cp ~/.ssh/known_hosts.old ~/.ssh/known_hosts

Fix Hashed Known Hosts

If your known_hosts uses hashed hostnames:

bash
head -1 ~/.ssh/known_hosts

Should start with |1|:

bash
|1|NcX9...|kYF2... ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI...

If hashed lines are malformed, you can't easily identify which host they belong to. Remove them and reconnect.

To decode hashed entries (if you know the hostname):

bash
ssh-keygen -H -F server.example.com -f ~/.ssh/known_hosts

This shows matching entries.

Remove Entries for Specific Host

Clean removal using ssh-keygen:

bash
ssh-keygen -R server.example.com

This properly removes entries, including hashed ones.

For IP address:

bash
ssh-keygen -R 192.168.1.100

Fix Permission Issues

Known_hosts file must have correct permissions:

bash
ls -la ~/.ssh/known_hosts

Should show:

bash
-rw------- 1 user user 1234 Apr  3 10:00 ~/.ssh/known_hosts

Fix if wrong:

bash
chmod 600 ~/.ssh/known_hosts

Also check the directory:

bash
chmod 700 ~/.ssh

Handle Encoding Issues

If the file has non-UTF8 characters:

bash
file ~/.ssh/known_hosts

Should show:

bash
~/.ssh/known_hosts: ASCII text

If it shows binary or other encoding, convert:

bash
iconv -f ISO-8859-1 -t UTF-8 ~/.ssh/known_hosts.corrupted > ~/.ssh/known_hosts

Or recreate from scratch.

Test Known Hosts After Repair

Verify SSH works:

bash
ssh -v user@server.example.com 2>&1 | grep "known_hosts"

Should show:

bash
debug1: checking match for 'server.example.com' file ~/.ssh/known_hosts line 10
debug1: Found key in ~/.ssh/known_hosts:10

Prevent Future Corruption

Enable hashing for security and to prevent manual editing errors:

bash
ssh-keygen -H

This hashes all hostnames in the file.

Use HashKnownHosts in your config:

bash
echo "HashKnownHosts yes" >> ~/.ssh/config

Use Separate Known Hosts Files

Maintain separate files for different environments:

bash
ssh -o UserKnownHostsFile=~/.ssh/known_hosts_work user@work-server

In ~/.ssh/config:

``` Host work-* UserKnownHostsFile ~/.ssh/known_hosts_work

Host personal-* UserKnownHostsFile ~/.ssh/known_hosts_personal ```

This limits corruption impact.

Check System-Wide Known Hosts

Sometimes the system-wide file is corrupted:

bash
cat /etc/ssh/ssh_known_hosts

If corrupted, contact your system administrator or fix:

bash
sudo ssh-keygen -R server.example.com -f /etc/ssh/ssh_known_hosts

Verify Known Hosts After Removal

After removing an entry and reconnecting:

bash
ssh-keygen -l -F server.example.com -f ~/.ssh/known_hosts

Should show the fingerprint:

bash
# Host server.example.com found: line 1
256 SHA256:abc123... server.example.com (ED25519)

Resolution Checklist

  1. 1.Check file for obvious corruption: cat ~/.ssh/known_hosts
  2. 2.Find malformed lines: awk '{if(NF<3) print NR": "$0}'
  3. 3.Remove specific lines: sed -i 'Nd'
  4. 4.Remove duplicates: sort -u
  5. 5.Backup and recreate if severely corrupted
  6. 6.Use ssh-keygen -R hostname for clean removal
  7. 7.Fix permissions: chmod 600
  8. 8.Enable HashKnownHosts yes for future entries

Known hosts file corruption is usually simple to fix. Remove malformed entries or recreate the file if damage is extensive. Always verify keys when reconnecting to ensure security.