SSH client silently deletes trusted host keys and exits 0 with empty stderr
OpenSSH with UpdateHostKeys enabled can rewrite known_hosts during a normal login, removing keys the server does not announce and adding new ones. The removal appears only at debug3 verbosity, with exit status 0 and nothing on stderr. Reproduced on OpenSSH 9.2p1.
- Key removal is logged only at debug3 with -vvv
- Requires a verified entry, an extra key and UpdateHostKeys on
- First connect with accept-new does not trigger the rewrite
- Diff known_hosts before and after connections to detect changes
Read next
Security