7

I have no deep understanding of SSH and I am a bit baffled about the relation between the /home/XXX/.ssh/known_hosts and /etc/ssh/ssh_known_hosts files.

Can someone explain this?

1
  • I want to automate ssh set up for our development env. I put the same public key to authorized_keys and ~/.ssh/known_hosts. But I am getting warnning - man-in-the-middle attack. I am trying ssh localhost. Complain about different fingerprint
    – jaksky
    Aug 30, 2013 at 14:11

3 Answers 3

13

The known_hosts file in your home directory is where ssh automatically stores the identity of every new server you visit. Other users will have their own known_hosts file, of course.

The file in /etc is the same thing, except that it can only be written to manually, and is shared between all users of the system.

A typical use for the /etc file is for the system administrator to enter the identities of all the servers inside your organization. This way each user will not have to answer "yes" when they first visit local resources, but, more importantly, it improves security.

The purpose of the known_hosts file is to prevent man-in-the-middle attacks by ensuring that you are connecting to the same server that you connected to last time (it hasn't been sneakily swapped out by a DNS hack or something). The known_hosts weakness is that it can't detect a man-in-the-middle if it happens the first time you connect. By prepopulating the /etc file with known-good signatures the administrator can be sure that his users are not being snooped on.

7
  • I want to automate ssh set up for our development env. I put the same public key to authorized_keys and ~/.ssh/known_hosts. But I am getting warnning - man-in-the-middle attack. I am trying ssh localhost. Complain about different fingerprint
    – jaksky
    Aug 30, 2013 at 14:03
  • The known_hosts file does not have the same format as authorized_keys. I'm not really sure what the format is. I normally just let it auto-generate an entry and then copy it from my known_hosts to wherever I need it.
    – ams
    Aug 30, 2013 at 14:10
  • If I add public key to /etc/ssh/ssh_known_hosts - do I need restart ssh service? Because I face an interactive request for adding to known_hosts
    – jaksky
    Aug 30, 2013 at 14:12
  • I compared the keys from auhorized_key and known_hosts and the key differ in some section. Otherwise I have correct frmat. I am just trying to understand if I take this key from known_hosts and put it on different server will that work?
    – jaksky
    Aug 30, 2013 at 14:17
  • I believe /etc/ssh/ssh_known_hosts file is only relevant on the client side, so there's nothing to restart.
    – ams
    Aug 30, 2013 at 14:17
4

From the ssh(1) man page, FILES section:

 ~/.ssh/known_hosts
         Contains a list of host keys for all hosts the user has logged
         into that are not already in the systemwide list of known host
         keys.  See sshd(8) for further details of the format of this
         file.

   ...

 /etc/ssh/ssh_known_hosts
         Systemwide list of known host keys.  This file should be prepared
         by the system administrator to contain the public host keys of
         all machines in the organization.  It should be world-readable.
         See sshd(8) for further details of the format of this file.
2
  • if in the same machine exists both files /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts - what of them has more preference? I am assuming the former, right? - consider to update your answer Sep 11, 2021 at 23:15
  • It's a combined list. Normally no preference would be needed. I'm not sure what happens if a machine changes its fingerprint and only one file is updated. "See sshd(8) for further details."
    – ams
    Sep 13, 2021 at 7:36
1

The /etc/ssh/ssh_known_hosts and $HOME/.ssh/known_hosts files contain host public keys for all known hosts. The global file should be prepared by the administrator (optional), and the per-user file is maintained automatically: whenever the user connects to an unknown host its key is added to the per-user file.

1
  • if in the same machine exists both files /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts - what of them has more preference? I am assuming the former, right? - consider to update your answer Sep 11, 2021 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.