Suppressing your IP address from being entered into the known_hosts file in setting up SSH

Question

We just recently set up a password-less connection between two servers. We have security concerns related to the contents of the known_hosts file. Basically the concern is if some one were to gain access to our system, and they were able to look in the known_hosts file they would get the IP address information to the rest of the servers linked to this box.

I'm searching for a way to suppress the IP address from being entered into the known_hosts file.

There is a solution in this article below on by-passing the check to see if the foreign server is a known host:

https://www.shellhacks.com/disable-ssh-host-key-checking/?unapproved=26927&moderation-hash=b2ec1001579980d3f812843f3cdac07e#comment-26927

The following statement will by-pass the known_hosts checking and will log you in to the foreign server without being prompted to enter that server information into the existing /ssh/known_hosts file. I'm including a quote from the article:

“you can skip the host key checking by sending the key to a null known_hosts file:

$ ssh -o “UserKnownHostsFile=/dev/null” -o “StrictHostKeyChecking=no” user@host”

When you implement this, in addition to suppressing being prompted by the known_hosts checking procedure, does the IP address of the server you’re connecting to still get stored in the existing /ssh/known_hosts file or does it not get stored anywhere? (i.e. “UserKnownHostsFile=/dev/null”)

If anyone is familiar with this type of command? I'm trying to get confirmation that it prevents the IP address from getting stored. From what I know about /dev/null/, it does look like this is the case however, I'm only 80% sure. Is there anyone out there that can confirm this confirm this. You don't really have to know SSH protocols, any Linux expert might know this.

When you redirect your UserKnownHostsFile to /dev/null as seen above does it, in fact, prevent your IP address from being stored in the .ssh/known_hosts file. Thanks!

Note that this is not the only file where you can find the IP addresses of recent ssh clients. They are for example also included in /var/log/wtmp — mashuptwice, Mar 01 '22 at 19:12
Also note that once someone has access to your system and stolen the keys, it's not that hard to scan the complete IPv4 range and try out the keys. So unless you are using IPv6 only, trying to "hide" the IPv4 addresses is not going to help. OTOH, disabling MITM tampering detection via known_hosts opens a new security hole. — dirkt, Mar 01 '22 at 19:44
And one more point: history will give the information about the host also :) — Romeo Ninov, Mar 01 '22 at 19:54
You could at least hash the entries - see Is it possible to find out the hosts in the known_hosts file? — steeldriver, Mar 01 '22 at 20:18

score 3 · Answer 1 · answered Mar 01 '22 at 20:30

The ssh configuration option HashKnownHosts causes ssh to store hostnames and IP addresses in known_hosts in a hashed form instead of as the raw names. The hashed form is a one-way transformation which doesn't allow recovering the original hostname or IP address. This allows you to use the known_hosts mechanism as intended, without storing raw hostnames or addresses in the files.

A hashed known_hosts entry looks like this:

|1|G9jVmIB3FBUJ70EpHtCM8PAJhMo=|AlMl5Apfpp3CR+Iy2gZTd+7y6bo= ssh-rsa AAAAB3Nz...

The ssh-keygen program can be used to help manage such a file:

ssh-keygen -H will convert an existing known_hosts file to hashed form.
ssh-keygen -F will search a known_hosts file for a particular hostname.
ssh-keygen -R can remove individual entries from the file.

Suppressing your IP address from being entered into the known_hosts file in setting up SSH

1 Answers1