As any user of SSH is aware, the first time you connect to a remote host, OpenSSH caches the server's public key in ~/.ssh/known_hosts. If the server's private key ever changes, SSH will raise an ugly error alerting you of the risk that an untrusted third-party could be intercepting your new connection.
Unfortunately, the known_hosts file represents a small security risk. It contains a convenient list of all servers to which you connect. An attacker who gained access to your password or unencrypted private key would simply need to iterate down the list until your credentials were accepted.
OpenSSH can optionally hash the server names in known_hosts. This renders the file useless to prying eyes without impairing SSH's ability to check hosts against the list. Enabling this feature and hashing your existing known_hosts file is easy!
- Add the parameter "
HashKnownHosts yes" to your~/.ssh/config. - Run "
ssh-keygen -H".
Below the fold, I included a handy shell script that accomplishes the same thing.
One final consideration is your shell history storing your ssh commands. It's easy to configure bash to forget these. Just set HISTIGNORE="ssh *:scp *:sftp *" in your ~/.bashrc.
#!/bin/sh
# Add parameter to existing config, if any
echo "HashKnownHosts yes" > ~/.ssh/config.new
if [ -f ~/.ssh/config ]; then
grep -v "^[[:space:]]*HashKnownHosts" \
~/.ssh/config \
>> ~/.ssh/config.new
fi
mv ~/.ssh/config.new ~/.ssh/config
# Hash existing known hosts
ssh-keygen -H
rm ~/.ssh/known_hosts.old
Leave a comment