SSH_DISCONNECT_HOST_KEY_NOT_VERIFIABLE
SSH_DISCONNECT_HOST_KEY_NOT_VERIFIABLE (9) is sent when the server's host key cannot be verified by the client. The client's known_hosts file has no matching entry, has a conflicting entry (MITM warning), or host key verification failed for another reason. The client disconnects rather than proceeding with an unverified server.
Code
9
Category
Disconnect
Standard
RFC 4253 §11.1
Description
SSH host key verification is the primary protection against man-in-the-middle attacks. When a client connects to an SSH server for the first time, it receives the server's public key. If StrictHostKeyChecking is enabled (the secure default), the client refuses to continue if it has no prior record of this server's key.
The most serious trigger is a host key mismatch: the server presents a different key than the one stored in known_hosts. This is the SSH warning message: WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! It could indicate a legitimate server key rotation, a reinstalled server, or an active MITM attack.
In automated environments (CI/CD pipelines, scripts), disconnect code 9 appears when the automation tool has no known_hosts configured. The fix is either to pre-populate known_hosts with the server's host key fingerprint, or to use ssh-keyscan to fetch and verify the key during setup.
Common Causes
- –Server's host key not in client known_hosts and StrictHostKeyChecking is yes
- –known_hosts entry for this host exists but with a different key (possible MITM)
- –Server's host key type (e.g., ecdsa) not accepted by client's policy
- –Automation tool with no known_hosts file connecting to a new server
- –Server key rotated after a reinstall without updating known_hosts