Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

By default, Debian and Ubuntu (at least) set /etc/ssh/ssh_known_hosts without read permission for others. What's the logic behind that? I can't think of any security risks with o+r, and, on the other hand, having it publicly readable is useful for admin-distributed files.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I would argue that the point of blocking access to that file is to prevent a intruder who has compromised your system from getting a list of hosts that your system my have access to. The similar logic applies to the HashKnownHosts option being enabled by default lately. You generally don't want your system to provide everything an intruder needs to get control of everything on your network.

If you only added hashed entries into your /etc/ssh/ssh_known_hosts I don't think it would really be as big of a deal since reversing the hash is not possible.

share|improve this answer

ssh keys should not be shared without good reason. /etc/ssh/* are configuration options that apply to all users. The ssh_known_hosts file is a way to specify a list of known hosts for all users that log into that box. I believe you can also add entries to /home/*/.ssh/known_hosts to apply a "known" host to a specific user. There should be no problems with the owner having read permissions.... in fact... all users should have read-permissions on that file. The concern is when you apply write permissions.

That file is used to identify the remote server's fingerprint... so when you ssh into your uber-secure server... you're actually ssh'ing into your server...and not some other server owned by a hacker that is playing man-in-the-middle.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.