By default, Debian and Ubuntu (at least) set /etc/ssh/ssh_known_hosts without read permission for others. What's the logic behind that? I can't think of any security risks with o+r, and, on the other hand, having it publicly readable is useful for admin-distributed files.
| |||
|
feedback
|
|
I would argue that the point of blocking access to that file is to prevent a intruder who has compromised your system from getting a list of hosts that your system my have access to. The similar logic applies to the If you only added hashed entries into your | |||
|
feedback
|
|
ssh keys should not be shared without good reason. /etc/ssh/* are configuration options that apply to all users. The ssh_known_hosts file is a way to specify a list of known hosts for all users that log into that box. I believe you can also add entries to /home/*/.ssh/known_hosts to apply a "known" host to a specific user. There should be no problems with the owner having read permissions.... in fact... all users should have read-permissions on that file. The concern is when you apply write permissions. That file is used to identify the remote server's fingerprint... so when you ssh into your uber-secure server... you're actually ssh'ing into your server...and not some other server owned by a hacker that is playing man-in-the-middle. | |||
|
feedback
|
