15

I have a host behind a dynamic IP, so I used to have a script that would add its address to my .ssh/known_hosts file, recently though it seems like something has changed. My file looks like its been attacked by the hash monster:

|1|Du0QWjqCUrdRK/pnE0PTww2O2Zk=|O31W+SPPLr9+sj1m1K7MfEb+xUQ= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILUT1234567Xu2vvCE1likgUSOXLzEV123456783asaA
|1|K3vgE86MLJTHx8W2sPv1cgP4DI0=|Jattsr5sEW443bnyMKT6W0Noc+k= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILUT1234567Xu2vvCE1likgUSOXLzEV123456783asaA
|1|UlAukzqGavXZvRtMzjvXmHoVeAQ=|0JVjq7YSFulCHmkF46VFwMV/ZBY= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILUT1234567Xu2vvCE1likgUSOXLzEV123456783asaA
  1. Is there anyway to go back to the old, less secure method?
  2. How can I easily create entries in this hashed format? (I want to write a script to tell ssh that any ip in the 10.0.0.0/24 range is should match the given fingerprint.)
2
  • 4
    Note that this is a security feature to prevent information disclosure (namely, to make it difficult for someone who gets a hold of your known hosts file to figure out what systems you’ve connected to, which in turn makes it harder for an attacker that0s compromised one system to compromise others you have access to). Commented Oct 3, 2022 at 12:30
  • "I have a host behind a dynamic IP ..." - Have you considered setting up DNS (perhaps with something like dyndns) for that host? That would be easier to use in general, and not require updating known_hosts.
    – marcelm
    Commented Oct 3, 2022 at 14:31

2 Answers 2

13

You can disable the hostname hashing by setting the HashKnownHosts SSH client option to "no": either each time on the command line (ssh -o HashKnownHosts=no ...) or in your user configuration file ~/.ssh/config like this:

Host *
  HashKnownHosts no

Not sure how you can hash a hostname yourself, but you can have intermixed entries in the known_hosts file, hashed and non-hashed ones, so it would be fine for your script to create non-hashed entries.

And you could use ssh-keygen -H to convert all entries in the known_hosts file to their hashed form.

1
  • One can also add HashKnownHosts = no in the user's .ssh/config file for each connection to overwrite the system-wide setting
    – Sven Haile
    Commented Mar 22 at 23:01
11

How can I easily create entries in this hashed format?

You don't say how exactly you are currently adding the key to the known hosts file, but I am going to assume that you are using ssh-keyscan, since that is the tool which is specifically designed for this exact use case:

ssh-keyscan is a utility for gathering the public SSH host keys of a number of hosts. It was designed to aid in building and verifying ssh_known_hosts files, the format of which is documented in sshd(8). ssh-keyscan provides a minimal interface suitable for use by shell and perl scripts.

So, I assume your script currently contains a line like this:

# Delete the entry for the old IP
ssh-keygen -R $OLD_IP

# Add entry for the new IP
ssh-keyscan $NEW_IP >> ~/.ssh/known_hosts

All you need to do is the add the -H flag to generate the output in the hashed format:

ssh-keyscan -H $NEW_IP >> ~/.ssh/known_hosts

(I want to write a script to tell ssh that any ip in the 10.0.0.0/24 range is should match the given fingerprint.)

I believe that could be achieved in a much simpler way.

SSH has a KnownHostsCommand configuration parameter which allows you to specify a command that outputs host key lines in the same format as the known hosts file. This command will be called after SSH has read the known hosts files and allows you to add additional entries on the fly, based on the information of the current connection attempt.

So, you could put something like this in your SSH configuration file:

Host 10.0.0.*
  KnownHostsCommand /usr/bin/env printf "%H ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILUT1234567Xu2vvCE1likgUSOXLzEV123456783asaA"

[I am using the /usr/bin/env trick here because SSH requires the path to the KnownHostsCommand to be absolute and the path for printf is not standardized. You can use the absolute path to printf on your system instead if you want to.]

So, what this means is: if the host you are trying to connect to matches the pattern 10.0.0.*, then add the result of calling the following command to the list of host keys. The command, in turn, uses the token %H (meaning "the host name we are trying to look up") and the string from your question to construct a valid known hosts key line for whatever IP address you are currently trying to connect to.

No need to litter your known hosts file with 254 identical entries.

2
  • The current method for adding hosts is simple really: I ssh into the machine, and it asks me if I want to add it as known. :P
    – fny
    Commented Oct 4, 2022 at 14:35
  • @fny Hahaha. "Security until it hurts" is the new slogan.
    – jrw32982
    Commented Mar 14 at 23:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .