Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some servers with yes, some other with no here (I only discovered this option today).

The advantages of HashKnownHosts no are that I can maintain the known_hosts file more easily.

What are the factual advantages of using HashKnownHosts yes ?

share|improve this question
up vote 7 down vote accepted

The known_hosts file represents a small security risk. It contains a convenient list of all servers to which you connect. An attacker who gained access to your password or unencrypted private key would simply need to iterate down the list until your credentials were accepted. Hashing resolves this or at least obfuscates the list.

share|improve this answer
This answer seems to have been copied without attribution from – Martey Jan 14 '12 at 13:29

With a cleartext known_hosts, attackers would easily know which servers you connect to. There is an article and an MIT paper about a potential ssh worm making use of a readable known_hosts. Of course usually there are other, yet more cumbersome ways to determine your daily ssh logins, such as your shell history, that an attacker could use.

Note that you can still work with your hashed known_hosts using the ssh-keygen utility program:

ssh-keygen -F myhost         # shows myhosts's line in the known_hosts file
ssh-keygen -l -F myhost      # additionally shows myhost's fingerprint
ssh-keygen -R myhost         # remove myhost's line from known_hosts

This, especially the last command, should be sufficient for 99% of cases users really need to access known_hosts. You will lose ssh host tab completion though, of course.

Also note that the command line options to ssh-keygen are case sensitive

There's also a relevant question at unix.SE.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.