When an SSH host key changes, is it rotation or interception?
An OpenSSH client refuses or prompts when a server presents a host key that differs from the entry in known_hosts . The protocol itself cannot tell whether the change is a controlled re-provisioning or a man-in-the-middle attack, so the decision falls entirely on the operator at that moment. The client-side settings are documented but easy to misread. Strict
ssh