I have no deep understanding of SSH and I am a bit baffled about the relation between the /home/XXX/.ssh/known_hosts and /etc/ssh/ssh_known_hosts files.
Can someone explain this?
-
I want to automate ssh set up for our development env. I put the same public key to authorized_keys and ~/.ssh/known_hosts. But I am getting warnning - man-in-the-middle attack. I am trying ssh localhost. Complain about different fingerprint– jakskyAug 30, 2013 at 14:11
Add a comment
|
3 Answers
The known_hosts file in your home directory is where ssh automatically stores the identity of every new server you visit. Other users will have their own known_hosts file, of course.
The file in /etc is the same thing, except that it can only be written to manually, and is shared between all users of the system.
A typical use for the /etc file is for the system administrator to enter the identities of all the servers inside your organization. This way each user will not have to answer "yes" when they first visit local resources, but, more importantly, it improves security.
The purpose of the known_hosts file is to prevent man-in-the-middle attacks by ensuring that you are connecting to the same server that you connected to last time (it hasn't been sneakily swapped out by a DNS hack or something). The known_hosts weakness is that it can't detect a man-in-the-middle if it happens the first time you connect. By prepopulating the /etc file with known-good signatures the administrator can be sure that his users are not being snooped on.
-
I want to automate ssh set up for our development env. I put the same public key to authorized_keys and ~/.ssh/known_hosts. But I am getting warnning - man-in-the-middle attack. I am trying ssh localhost. Complain about different fingerprint– jakskyAug 30, 2013 at 14:03
-
The
known_hostsfile does not have the same format asauthorized_keys. I'm not really sure what the format is. I normally just let it auto-generate an entry and then copy it from myknown_hoststo wherever I need it.– amsAug 30, 2013 at 14:10 -
If I add public key to /etc/ssh/ssh_known_hosts - do I need restart ssh service? Because I face an interactive request for adding to known_hosts– jakskyAug 30, 2013 at 14:12
-
I compared the keys from auhorized_key and known_hosts and the key differ in some section. Otherwise I have correct frmat. I am just trying to understand if I take this key from known_hosts and put it on different server will that work?– jakskyAug 30, 2013 at 14:17
-
I believe
/etc/ssh/ssh_known_hostsfile is only relevant on the client side, so there's nothing to restart.– amsAug 30, 2013 at 14:17
From the ssh(1) man page, FILES section:
~/.ssh/known_hosts
Contains a list of host keys for all hosts the user has logged
into that are not already in the systemwide list of known host
keys. See sshd(8) for further details of the format of this
file.
...
/etc/ssh/ssh_known_hosts
Systemwide list of known host keys. This file should be prepared
by the system administrator to contain the public host keys of
all machines in the organization. It should be world-readable.
See sshd(8) for further details of the format of this file.
answered Aug 30, 2013 at 13:46
-
if in the same machine exists both files
/etc/ssh/ssh_known_hostsand~/.ssh/known_hosts- what of them has more preference? I am assuming the former, right? - consider to update your answer Sep 11, 2021 at 23:15 -
It's a combined list. Normally no preference would be needed. I'm not sure what happens if a machine changes its fingerprint and only one file is updated. "See sshd(8) for further details."– amsSep 13, 2021 at 7:36
The /etc/ssh/ssh_known_hosts and $HOME/.ssh/known_hosts
files contain host public keys for all known hosts. The global file should be prepared by the administrator (optional),
and the per-user file is maintained automatically: whenever
the user connects to an unknown host its key is added to
the per-user file.
-
if in the same machine exists both files
/etc/ssh/ssh_known_hostsand~/.ssh/known_hosts- what of them has more preference? I am assuming the former, right? - consider to update your answer Sep 11, 2021 at 23:15