0

We just recently set up a password-less connection between two servers. We have security concerns related to the contents of the known_hosts file. Basically the concern is if some one were to gain access to our system, and they were able to look in the known_hosts file they would get the IP address information to the rest of the servers linked to this box.

I'm searching for a way to suppress the IP address from being entered into the known_hosts file.

There is a solution in this article below on by-passing the check to see if the foreign server is a known host:

https://www.shellhacks.com/disable-ssh-host-key-checking/?unapproved=26927&moderation-hash=b2ec1001579980d3f812843f3cdac07e#comment-26927

The following statement will by-pass the known_hosts checking and will log you in to the foreign server without being prompted to enter that server information into the existing /ssh/known_hosts file. I'm including a quote from the article:

“you can skip the host key checking by sending the key to a null known_hosts file:

$ ssh -o “UserKnownHostsFile=/dev/null” -o “StrictHostKeyChecking=no” user@host”

When you implement this, in addition to suppressing being prompted by the known_hosts checking procedure, does the IP address of the server you’re connecting to still get stored in the existing /ssh/known_hosts file or does it not get stored anywhere? (i.e. “UserKnownHostsFile=/dev/null”)

If anyone is familiar with this type of command? I'm trying to get confirmation that it prevents the IP address from getting stored. From what I know about /dev/null/, it does look like this is the case however, I'm only 80% sure. Is there anyone out there that can confirm this confirm this. You don't really have to know SSH protocols, any Linux expert might know this.

When you redirect your UserKnownHostsFile to /dev/null as seen above does it, in fact, prevent your IP address from being stored in the .ssh/known_hosts file. Thanks!

4
  • 1
    Note that this is not the only file where you can find the IP addresses of recent ssh clients. They are for example also included in /var/log/wtmp Mar 1, 2022 at 19:12
  • 1
    Also note that once someone has access to your system and stolen the keys, it's not that hard to scan the complete IPv4 range and try out the keys. So unless you are using IPv6 only, trying to "hide" the IPv4 addresses is not going to help. OTOH, disabling MITM tampering detection via known_hosts opens a new security hole.
    – dirkt
    Mar 1, 2022 at 19:44
  • 1
    And one more point: history will give the information about the host also :) Mar 1, 2022 at 19:54
  • 1
    You could at least hash the entries - see Is it possible to find out the hosts in the known_hosts file? Mar 1, 2022 at 20:18

1 Answer 1

3

The ssh configuration option HashKnownHosts causes ssh to store hostnames and IP addresses in known_hosts in a hashed form instead of as the raw names. The hashed form is a one-way transformation which doesn't allow recovering the original hostname or IP address. This allows you to use the known_hosts mechanism as intended, without storing raw hostnames or addresses in the files.

A hashed known_hosts entry looks like this:

|1|G9jVmIB3FBUJ70EpHtCM8PAJhMo=|AlMl5Apfpp3CR+Iy2gZTd+7y6bo= ssh-rsa AAAAB3Nz...

The ssh-keygen program can be used to help manage such a file:

  • ssh-keygen -H will convert an existing known_hosts file to hashed form.
  • ssh-keygen -F will search a known_hosts file for a particular hostname.
  • ssh-keygen -R can remove individual entries from the file.

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .