Do yourself (and us) a favor, and execute

`ssh-keygen -H -f ~/.ssh/known_hosts`

...on whichever host you're using as your OpenSSH client.

#OpenSSH #FreeBSD

@mr0vka Oh! This is a feature I requested!

Something around 20 years ago (2003ish?) we had a machine compromise and then the attacker used the known-hosts file to find all of the machines where the keys that they’d compromised worked and attacked those as well.

I dropped into the OpenBSD IRC chat and explained this attack and that hashing the host names in the known-hosts file would make it much harder (an attacker could still probe whether a particular host was on the list but that’s just turning an online attack into an offline one since they could also just try connecting to that host with the stolen credentials).

The OpenSSH folks in the channel understood quickly and the feature appeared a little bit later. I think it’s on by default in OpenBSD.

@david_chisnall I absolutely hated this as a red teamer, thanks! :)

@mr0vka

@buherator @mr0vka

I like to make life hard for the red team. Ask @amarsaar .