By default, Debian and Ubuntu (at least) set
/etc/ssh/ssh_known_hosts without read permission for others. What's the logic behind that? I can't think of any security risks with
o+r, and, on the other hand, having it publicly readable is useful for admin-distributed files.
I would argue that the point of blocking access to that file is to prevent a intruder who has compromised your system from getting a list of hosts that your system my have access to. The similar logic applies to the
If you only added hashed entries into your
ssh keys should not be shared without good reason. /etc/ssh/* are configuration options that apply to all users. The ssh_known_hosts file is a way to specify a list of known hosts for all users that log into that box. I believe you can also add entries to /home/*/.ssh/known_hosts to apply a "known" host to a specific user. There should be no problems with the owner having read permissions.... in fact... all users should have read-permissions on that file. The concern is when you apply write permissions.
That file is used to identify the remote server's fingerprint... so when you ssh into your uber-secure server... you're actually ssh'ing into your server...and not some other server owned by a hacker that is playing man-in-the-middle.