9

I have no deep understanding of SSH and I am a bit baffled about the relation between the /home/XXX/.ssh/known_hosts (or ~/.ssh/known_hosts) and /etc/ssh/ssh_known_hosts files.

Can someone explain this?

1
  • I want to automate ssh set up for our development env. I put the same public key to authorized_keys and ~/.ssh/known_hosts. But I am getting warnning - man-in-the-middle attack. I am trying ssh localhost. Complain about different fingerprint
    – jaksky
    Commented Aug 30, 2013 at 14:11

3 Answers 3

16

The known_hosts file in your home directory is where ssh automatically stores the identity of every new server you visit. Other users will have their own known_hosts file, of course.

The file in /etc is the same thing, except that it can only be written to manually, and is shared between all users of the system.

A typical use for the /etc file is for the system administrator to enter the identities of all the servers inside your organization. This way each user will not have to answer "yes" when they first visit local resources, but, more importantly, it improves security.

The purpose of the known_hosts file is to prevent man-in-the-middle attacks by ensuring that you are connecting to the same server that you connected to last time (it hasn't been sneakily swapped out by a DNS hack or something). The known_hosts weakness is that it can't detect a man-in-the-middle if it happens the first time you connect. By prepopulating the /etc file with known-good signatures the administrator can be sure that his users are not being snooped on.

7
  • I want to automate ssh set up for our development env. I put the same public key to authorized_keys and ~/.ssh/known_hosts. But I am getting warnning - man-in-the-middle attack. I am trying ssh localhost. Complain about different fingerprint
    – jaksky
    Commented Aug 30, 2013 at 14:03
  • The known_hosts file does not have the same format as authorized_keys. I'm not really sure what the format is. I normally just let it auto-generate an entry and then copy it from my known_hosts to wherever I need it.
    – ams
    Commented Aug 30, 2013 at 14:10
  • If I add public key to /etc/ssh/ssh_known_hosts - do I need restart ssh service? Because I face an interactive request for adding to known_hosts
    – jaksky
    Commented Aug 30, 2013 at 14:12
  • I compared the keys from auhorized_key and known_hosts and the key differ in some section. Otherwise I have correct frmat. I am just trying to understand if I take this key from known_hosts and put it on different server will that work?
    – jaksky
    Commented Aug 30, 2013 at 14:17
  • I believe /etc/ssh/ssh_known_hosts file is only relevant on the client side, so there's nothing to restart.
    – ams
    Commented Aug 30, 2013 at 14:17
5

From the ssh(1) man page, FILES section:

~/.ssh/known_hosts

    Contains a list of host keys for all hosts the user has logged into that are not already in the systemwide list of known host keys.  See sshd(8) for further details of the format of this file.

  ...

/etc/ssh/ssh_known_hosts

    Systemwide list of known host keys.  This file should be prepared by the system administrator to contain the public host keys of all machines in the organization.  It should be world-readable.  See sshd(8) for further details of the format of this file.

Here is the link to sshd(8).

2
  • if in the same machine exists both files /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts - what of them has more preference? I am assuming the former, right? - consider to update your answer Commented Sep 11, 2021 at 23:15
  • 1
    It's a combined list. Normally no preference would be needed. I'm not sure what happens if a machine changes its fingerprint and only one file is updated. "See sshd(8) for further details."
    – ams
    Commented Sep 13, 2021 at 7:36
1

The /etc/ssh/ssh_known_hosts and $HOME/.ssh/known_hosts files contain host public keys for all known hosts. The global file should be prepared by the administrator (optional), and the per-user file is maintained automatically: whenever the user connects to an unknown host its key is added to the per-user file.

1
  • 1
    if in the same machine exists both files /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts - what of them has more preference? I am assuming the former, right? - consider to update your answer Commented Sep 11, 2021 at 23:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .