after changed ssh keys in both (client and server), a script that runs on the ssh client first give to the server two wrong public keys (probably the olds) then the right one.
gen 10 23:34:31 server sshd[25230]: Connection from client port 54948 on server port 53799 rdomain ""
gen 10 23:34:31 server sshd[25231]: Connection from client port 54958 on server port 53799 rdomain ""
gen 10 23:34:31 server sshd[25231]: Failed publickey for user1 from client port 54958 ssh2: ED25519 SHA256:wrong_key1
gen 10 23:34:31 server sshd[25230]: Failed publickey for user1 from client port 54948 ssh2: ED25519 SHA256:wrong_key1
gen 10 23:34:31 server sshd[25230]: Failed publickey for user1 from client port 54948 ssh2: ED25519 SHA256:wrong_key2
gen 10 23:34:31 server sshd[25231]: Failed publickey for user1 from client port 54958 ssh2: ED25519 SHA256:wrong_key2
gen 10 23:34:31 server sshd[25231]: Accepted key ED25519 SHA256:right_key found at /home/user1/.ssh/authorized_keys:1
gen 10 23:34:31 server sshd[25230]: Accepted key ED25519 SHA256:right_key found at /home/user1/.ssh/authorized_keys:1
gen 10 23:34:31 server sshd[25231]: Postponed publickey for user1 from client port 54958 ssh2 [preauth]
gen 10 23:34:31 server sshd[25230]: Postponed publickey for user1 from client port 54948 ssh2 [preauth]
gen 10 23:34:31 server sshd[25230]: Accepted key ED25519 SHA256:right_key found at /home/user1/.ssh/authorized_keys:1
gen 10 23:34:31 server sshd[25231]: Accepted key ED25519 SHA256:right_key found at /home/user1/.ssh/authorized_keys:1
gen 10 23:34:31 server sshd[25231]: Accepted publickey for user1 from client port 54958 ssh2: ED25519 SHA256:right_key
gen 10 23:34:31 server sshd[25230]: Accepted publickey for user1 from client port 54948 ssh2: ED25519 SHA256:right_key
gen 10 23:34:31 server sshd[25230]: pam_unix(sshd:session): session opened for user user1(uid=1000) by user1(uid=0)
gen 10 23:34:31 server sshd[25231]: pam_unix(sshd:session): session opened for user user1(uid=1000) by user1(uid=0)
I deleted the old keys from /home/user1/.ssh/ but cannot find where ssh store those two wrong public keys it sends at the beginning to the server
Any clue ?