3 ms·
Also use "hashknownhosts yes" in your user ssh config file. Makes it another level harder to see where you went, though a compromised root would see all of the
by khaki54 12y ago
Also use "hashknownhosts yes" in your user ssh config file. Makes it another level harder to see where you went, though a compromised root would see all of the logs.
- scintill76 12y agoI've posted (rambled?) about why I think HashKnownHosts is an overly cumbersome idea, and even a suboptimal security practice: http://blog.joeyhewitt.com/2013/12/openssh-hashknownhosts-a-bad-idea/ http://blog.joeyhewitt.com/2013/12/openssh-hashknownhosts-a-... . Summary: "An opaque, difficult-to-audit trusted key database could be a security liability of its own. This file isn't some MRU auto-completion nicety, it's a security mechanism to prevent man-in-the-middle attacks." If you type in all your connection details by hand every time you ssh (can't store them anywhere, or the bad guys will see the servers you use), your shell doesn't log your ssh command lines in history, you don't mind having no idea what's actually in your known_hosts file, and you think attackers who care will be unable to dictionary-crack your hashes, then HashKnownHosts will accomplish something for you. Otherwise it's dumb, IMO. Open to hearing about something I've missed, though, or just people whose usecase differs enough that my points don't apply to them.