Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I would like to see what hosts are in my known_hosts file but it doesn't appear to be human readable. Is it possible to read it?

More specifically there is a host that I can connect to via several names and I want to find out what the fingerprint I expect for it from my known hosts file.

Update: I'm using OpenSSH_5.3p1 Debian-3ubuntu7, OpenSSL 0.9.8k 25 Mar 2009

A line from my known_hosts file looks something like this,

|1|guO7PbLLb5FWIpxNZHF03ESTTKg=|r002DA8L2JUYRVykUh7jcVUHeYE= ssh-rsa AAAAB3NzaC1yc2EAAFADAQABAAABAQDWp73ulfigmbbzif051okmDMh5yZt/DlZnsx3DEOYHu3Nu/+THJnUAfkfEc1XkOFiFgbUyK/08Ty0K6ExUaffb1ERfXXyyp63rpCTHOPonSrnK7adl7YoPDd4BcIUZd1Dk7HtuShMmuk4l83X623cr9exbfm+DRaeyFNMFSEkMzztBYIkhpA2DWlDkd90OfVAvyoOrJPxztmIZR82qu/5t2z58sJ6Jm2xdp2ckySgXulq6S4k+hnnGuz2p1klviYCWGJMZfyAB+V+MTjGGD/cj0SkL5v/sa/Fie1zcv1SLs466x3H0kMllz6gAk0/FMi7eULspwnIp65g45qUAL3Oj
share|improve this question
add comment

4 Answers 4

up vote 24 down vote accepted

You've got HashKnownHosts set to "yes" in your ssh_config file, so the hostnames aren't available in plaintext.

If you know the hostname you're looking for ahead of time, you can search for it with:

    ssh-keygen -H -F hostname

Here's the relevant section from the ssh-keygen(1) man page:

 -F hostname
         Search for the specified hostname in a known_hosts file, listing
         any occurrences found.  This option is useful to find hashed host
         names or addresses and may also be used in conjunction with the
         -H option to print found keys in a hashed format.
share|improve this answer
    
Does hash known hosts essentially mean it's not possible? i.e. I need to know the name of the host in order to look at it's info? –  Colin Newell Feb 13 '12 at 15:54
2  
@ColinNewell That's right, you need to know the hostname(s). It's a security measure to keep an attacker from harvesting hostnames/IP addresses of other boxes you frequent if your machine is compromised. –  pdo Feb 13 '12 at 15:58
    
Don't be scared when there is no output at all, but try not the full qualified hostname but the hostname instead. –  math May 7 '13 at 17:58
4  
Not sshd_config, but ssh_config. –  fossilet Nov 21 '13 at 10:31
1  
@pdo - your command does not always work. If the host has SSH on port other than 22, then the format in known_hosts is different. Then you have to use the following command: ssh-keygen -H -F [host.example.com]:2222 –  Martin Vegter Jul 13 at 15:56
add comment

For future searchers, this article (non-disclaimer: I'm not affilated) has a relatively simple Perl script to brute-force hashed IPs and hostnames in known_hosts.

http://blog.rootshell.be/2010/11/03/bruteforcing-ssh-known_hosts-files/

It allows starting from a particular IP address. It could also easily be modified to use a dictionary.

Also, in June 2014, the John the Ripper project added support for known_hosts cracking, which can take advantage of multiple CPU cores, GPUs, dictionary mangling, etc.

You can also use this nmap snippet to generate a dictionary of all RFC1918 IP addresses to use as a dictionary:

nmap -sL -Pn -n 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 |\
    grep '^Nmap scan report for' | cut -d\  -f5 >ips.list
share|improve this answer
1  
There is also a python implementation with similar features, can be found at: blog.tremily.us/posts/known_hosts –  Lars Nordin Jun 12 at 14:44
    
Lars Nordin, thanks for the tip. I submitted Remily's info to the John the Ripper team, and they added support for this in bleeding-jumbo: openwall.com/lists/john-users/2014/07/02/2 –  Royce Williams Jul 13 at 15:00
add comment

There is host string/ip at the beginning of each "known_hosts" line (before the "ssh-dss" or "ssh-rsa" string):

hostgn6 ssh-dss AAAB3NzaC1kc3MAAACBAIfGV4+/28Zr+dT/i+ifydUBS0dMRUjCtExIThOj3Yexynu+wSRGjMm4GfF+og2kAljZyUjhBFeM+WYbJzcDSDB [...] ==
yumyumn6.dik6.dir2g.some.net ssh-dss AAAAB3NzaC1kc3MAAACBAIfGV4+/28Zr+dT/i+ifydUBS0dMRUjCtExITh [...] ==
share|improve this answer
1  
...and thus awk '{print $1}' known_hosts does the trick. Be aware that servers listening on non-standard ports end up as, say, [some-server]:5555 in known_hosts. –  sr_ Feb 13 '12 at 14:35
3  
Unfortunately not in mine. Mine looks more like base64 encoded data. The data is also pipe delimited in my file. –  Colin Newell Feb 13 '12 at 14:40
    
Which ssh software are you using then (we were assuming that you were using the almost-standart openssh software) ? –  Ouki Feb 13 '12 at 14:49
    
I've added more details to my question. –  Colin Newell Feb 13 '12 at 15:11
3  
As stated by @pdo, your sshd as "HashKnownHosts" set to on, which may appear a bit anal, but security concern it is. And of course there is no way to simply reverse the hashes and get the hostnames from your "known_hosts". –  Ouki Feb 13 '12 at 15:41
add comment

Does ssh-keygen -l -f ~/.ssh/known_hosts help? (Using -vyou also get nice little treasure maps, e.g.

+--[ RSA 2048]----+
|        .        |
|       + .       |
|      . B .      |
|     o * +       |
|    X * S        |
|   + O o . .     |
|    .   E . o    |
|       . . o     |
|        . .      |
+-----------------+
share|improve this answer
    
Not in the strictest sense no, it's all still base64. pdo's explanation of it being hashed suggests it's a one way thing so I guess I'm stuck unless I know the hostname. –  Colin Newell Feb 13 '12 at 15:57
add comment

protected by slm Jun 11 at 13:23

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.