What do the different parts of "known_hosts" entries mean?
Below is an known_hosts
entry. The part that starts with ssh-rsa
and goes to the end is a public key. What are the other parts (the characters before ssh-rsa
)?
|1|KnbIIJIPrL/1p7ofUV74sK+j/Gc=|wrjOFnPgoF0afgH0PeRtRqSdgvc= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
The |1|
is the HASH_MAGIC, indicating that it is a hashed known_hosts entry.
The next two base-64 encoded fields (delimited by |
) are the randomly-generated salt and the SHA-1 hash of the host.
If you are using an older version of OpenSSH, or if you have HashKnownHosts No
set in your /etc/ssh/ssh_config
or ~/.ssh/config`, the entries are not hashed and look more like this:
remotehostname,192.168.1.100 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdn...etc...
From the sshd(8)
man page, SSH_KNOWN_HOSTS FILE FORMAT section:
Each line in these files contains the following fields: markers (optional), hostnames, bits, exponent, modulus, comment. The fields are separated by spaces.
...
Alternately, hostnames may be stored in a hashed form which hides host names and addresses should the file’s contents be disclosed. Hashed hostnames start with a ‘|’ character. Only one hashed hostname may appear on a single line and none of the above negation or wildcard opera- tors may be applied.