If I run git clone git@github.com:some-org/some-repo.git, I'm prompted with the following:

The authenticity of host 'github.com (' can't be established.
RSA key fingerprint is SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8.

Obviously, I verify the fingerprint against the list at https://help.github.com/articles/github-s-ssh-key-fingerprints/, and respond yes:

Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'github.com,' (RSA) to the list of known hosts.

That results in two entries being added to my ~/.ssh/known_hosts file, both with the same key, both hashed.

If I confirm the key with ssh-keyscan github.com, the key matches.

But why do I have two entries in known_hosts, rather than one?

  • where do you see two entries? I see only IP and hostname in your question (which is totally not related to the two IPs in the answer). – Jakuje Jun 16 '17 at 11:30
  • I see two entries in the known_hosts file. It was non-existent (i.e. empty) until I answered 'yes' to the prompt. Somehow, git clone over ssh knew to add two entries, instead of the one that I see with ssh-keyscan. – Roger Lipscombe Jun 16 '17 at 11:31
  • But still I don't have a magic crystal ball and I don't see what you see in your known hosts file without you adding them to the question. – Jakuje Jun 16 '17 at 11:33
  • I thought that "That results in two entries...with the same key" was pretty clear. I wanted to avoid pasting the actual keys into the question. – Roger Lipscombe Jun 16 '17 at 11:46
  • 1
    Ah. I see that I didn't (in the question) clarify that these were hashed entries. – Roger Lipscombe Jun 16 '17 at 11:58

Normally, the known_hosts file contains a list of the hostnames/IP addresses on every line. But this is not used when the hostnames are hashed (for simplification of the matching?) as described in the manual page for sshd:

Alternately, hostnames may be stored in a hashed form which hides host names and addresses should the file's contents be disclosed. Hashed hostnames start with a ‘|’ character. Only one hashed hostname may appear on a single line and none of the above negation or wildcard operators may be applied.

So to answer your question,

But why do I have two entries in known_hosts, rather than one?

One of them is github.com and the other exactly as you confirmed in the prompt

Warning: Permanently added 'github.com,' (RSA) to the list of known hosts.

If you turn the known hosts hashing off (there is no good reason to do that), you will get only one line such as I have:

github.com, ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==

  • for simplification of the matching? Not only that. A hash of a hostname list would never be the same as any of the single hostname hashes. Simply because the way hashes are created. :) – Esa Jokinen Jun 16 '17 at 17:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.