Understand known_hosts

A rebuilt disposable server has a legitimately new key, but the operator confirms the rebuild before removing only the old entry. That contrast gives us something useful to test instead of a rule to memorize.

known_hosts records host identities so a future change becomes a loud security event. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

The happy path can hide a bad design: you can delete the entire known_hosts file whenever one host changes and still get one successful demo. Push past the demo. locate the exact matching entry, investigate why it changed, verify the replacement, and update only that host, then test the condition most likely to prove the choice wrong.

The module is moving toward one outcome: Connect to the intended host and know exactly which identity, network path, and trust decision made it possible. Save the before-and-after evidence now; it will make the final project review much more honest.

Trigger a controlled host-key mismatch and document the investigation and narrow repair. Save the evidence, then explain which requirement would force you to choose a different design.