Debian 12 – rsync over SSH fails due to host key mismatch – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Rsync jobs abort due to host key verification errors, interrupting replication and backups.

Environment & Reproduction

Appears after destination host rebuild, IP reassignment, or key rotation.

rsync -avz /src user@host:/dst
ssh user@host
cat ~/.ssh/known_hosts | tail -n 20

Root Cause Analysis

Known host fingerprint no longer matches current remote host key.

Quick Triage

Capture presented key fingerprint and compare with trusted source.

ssh-keygen -F host
ssh-keyscan -H host
ssh -o StrictHostKeyChecking=ask user@host

Step-by-Step Diagnosis

Verify mismatch scope across user and system known_hosts files.

grep -RIn "host key|known_hosts" ~/.ssh /etc/ssh 2>/dev/null
ssh-keygen -R host
ssh-keyscan -H host | head -n 5

Solution – Primary Fix

Remove stale key entries and enroll validated new fingerprint.

ssh-keygen -R host
ssh-keyscan -H host >> ~/.ssh/known_hosts
ssh user@host 'echo ok'
rsync -avz /src user@host:/dst

Solution – Alternative Approaches

Use host certificates or centralized SSH CA for key lifecycle control.

grep -RIn '@cert-authority' ~/.ssh /etc/ssh 2>/dev/null
ssh -G user@host | grep -i hostkeyalgorithms
rsync --version

Verification & Acceptance Criteria

SSH and rsync complete without interactive key warnings.

ssh -o BatchMode=yes user@host 'true'
rsync -avz --dry-run /src user@host:/dst
echo $?

Rollback Plan

Restore previous known_hosts backup if trusted key validation fails.

cp ~/.ssh/known_hosts ~/.ssh/known_hosts.bak.$(date +%s)
cat ~/.ssh/known_hosts.bak.* | tail -n 20
ssh-keygen -F host

Prevention & Hardening

Track host fingerprints in inventory and rotate keys with change control.

ssh-keyscan -H host > /var/tmp/host.key
sha256sum /var/tmp/host.key
cat /var/tmp/host.key

Related Errors & Cross-Refs

Can overlap with DNS drift and bastion/jump-host route changes.

Related tutorial: View the step-by-step tutorial for Debian 12.

View all Debian 12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

OpenSSH host key verification and Debian SSH operations docs.