Debian 11: rsync over SSH fails after host key rotation

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Backup sync jobs fail because SSH host key trust no longer matches the remote endpoint.

Environment & Reproduction

Rsync aborts with host key verification failed and scheduled backups miss their windows.

Root Cause Analysis

Run `ssh -vv backup@host` and compare presented fingerprints with approved rotation records.

Quick Triage

Legitimate host key rotation was not propagated to automation accounts or known_hosts files.

Step-by-Step Diagnosis

After out-of-band fingerprint validation, remove stale key entries and store the new trusted key.

Solution – Primary Fix

Execute a dry-run `rsync –dry-run` job and confirm normal SSH trust prompts are gone.

Solution – Alternative Approaches

Integrate host key lifecycle updates into change management for backup endpoints.

Verification & Acceptance Criteria

Pause replication and restore previous endpoint if fingerprint validation cannot be completed safely.

Rollback Plan

Distribute signed known_hosts updates centrally to all backup clients.

Prevention & Hardening

`ssh-keygen -R backup.example.net`; `ssh-keyscan -H backup.example.net`; `rsync –dry-run -avz src/ backup@host:/dst/`

Related Errors & Cross-Refs

Include key fingerprints, rotation ticket IDs, and failed job logs in escalation notes.

Related tutorial: View the step-by-step tutorial for debian-11.

View all debian-11 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Never suppress strict host key checks permanently in production backup workflows.