#1053737 /usr/bin/ssh-keygen: ssh-keygen -R: "invalid line" errors

Package:
openssh-client
Source:
openssh-client
Description:
secure shell (SSH) client, for secure access to remote machines
Submitter:
Matija Nalis
Date:
2025-11-28 15:49:02 UTC
Severity:
normal
#1053737#5
Date:
2023-10-09 21:36:50 UTC
From:
To:
Dear Maintainer,

   * What led up to the situation?

Trying to execute:
 ssh-keygen -f "/home/mnalis/.ssh/known_hosts" -R "github.com"

(exact command as suggested by ssh itself because host key changed,
 probably due to https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/)

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

Tried on another machine with openssh-client 1:9.4p1-1, the same problem is
present there for this known_hosts file too.  Manually editing the file and
removing line 200 works around the specific instance of the problem, but
"ssh-keygen -R" remains unusable. I assume that manually removing all
lines detected as "invalid line" would also allow ssh-keygen to proceed,
but I have not tested it.

   * What was the outcome of this action?

ssh-keygen refuses to update known_hosts with following error:

% ssh-keygen -f "/home/mnalis/.ssh/known_hosts" -R "github.com"
/home/mnalis/.ssh/known_hosts:1: invalid line
/home/mnalis/.ssh/known_hosts:2: invalid line
/home/mnalis/.ssh/known_hosts:4: invalid line
/home/mnalis/.ssh/known_hosts:16: invalid line
/home/mnalis/.ssh/known_hosts:17: invalid line
# Host github.com found: line 200
/home/mnalis/.ssh/known_hosts is not a valid known_hosts file.
Not replacing existing known_hosts file because of errors

Here is how first 4 lines of that known_hosts file look like:

|1|DCvQVwzVexcX3Mau1D5fZmVKruM=|soAN7Mhjth9ExnFxG47y++6LLHg= 1024 35 167434766793837483340248804980769949824665268604993978563358959479765830951370741558908832827011687207884480786428301345738847818832072690127564924719644302715664485137952117178027506363037390447008852228373472317454193197538959482837286051143224351239595700806436016270258891540041265360900792522259140180921
|1|amNEFjA4gEiPAJp/hZepdJ1a38A=|3r0i0zg3DJ9iiaAcpdPfLNrhUrw= 1024 35 167434766793837483340248804980769949824665268604993978563358959479765830951370741558908832827011687207884480786428301345738847818832072690127564924719644302715664485137952117178027506363037390447008852228373472317454193197538959482837286051143224351239595700806436016270258891540041265360900792522259140180921
|1|+Q0EQTlTQeJ0jfLrk4Bhhyq7tic=|OtfKGw6dQ8Sw3BsH3MsRxj/+am8= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAoSZK2F7aXr0UxG8TqyqRiVKK1redIINJw2XHAFYwg+fRT4QxRGWANoZO4ggK6SB1dV0JsIvfJr/D7VGNiwfLT/i+K/EWt1jQ1Y13cLhzqqSrsUOWvsr2xC+re8QeSILk5pzP5nzQEYTyyBknCq0yCjnuRKm9MhqQOrcgY2GMB3U=
|1|zlwmrL64HaBaMTElBLAjB5wfiNE=|aqU2HeyZ00Nb16tHDcnZF/KALYI= 1024 35 127996390308881367982749181615590389946112714634614519843262364092321681710130910232611431762945334377336640067840062246513041629962755479231984134203580650174397517780096139161960264450818602524143591999435168314030504459201667428786398279613415241098669732580262057385208616093432930475934719992598708459451

That machine on which known_hosts exist, has been updated for many Debian
versions (at least from Squeeze, probably from Woody).  I seem to recall
that the known_hosts contained plaintext FQDNs back in the time, and then
some version decided to convert them to currently used hashed format.

It seem that not all lines that were converted are recognized by recent
openssh versions.

   * What outcome did you expect instead?

that the offending line at line 200 is removed.
#1053737#10
Date:
2024-08-22 15:00:19 UTC
From:
To:
Package: openssh-client
Version: 1:9.8p1-3
Followup-For: Bug #1053737
X-Debbugs-Cc: hobbes@poukram.net

Hi,

just to add that the same problem exists for ssh-dss keytypes

I have 3 of them in my known_hosts file, and ssh-keygen is now useless for me.

Thanks,
#1053737#15
Date:
2025-11-28 15:48:23 UTC
From:
To:
Control: found -1 1:10.0p1-8
Control: found -1 1:10.2p1-2

Ditto for me.