Knownhosts

Knownhosts, in the context of SSH, refers to the file that records the public key fingerprints of servers a user has connected to. It serves to verify the remote machine’s identity in future sessions and to detect possible man-in-the-middle attacks where a server may present a different key.

Location and scope: The per-user known hosts file is typically located at ~/.ssh/known_hosts. There is also a system-wide variant at /etc/ssh/ssh_known_hosts. OpenSSH and other SSH implementations may offer privacy options such as HashKnownHosts, which stores hostnames in hashed form to prevent exposing real names in the file.

Format: Each entry corresponds to a host or a group of hosts and includes the host name or pattern, the key type (for example ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp-256), and the base64-encoded public key. A single line can contain multiple host names or patterns separated by commas, followed by the key type and key data.

Use and management: When connecting to a host for the first time, SSH may append the server’s key to the known_hosts file, depending on configuration. You can inspect entries with ssh-keygen -F hostname, or remove an entry with ssh-keygen -R hostname. New entries can be added manually by appending, or automatically via ssh-keyscan, which can be redirected to the known_hosts file. SSH configurations may also disable strict checking or switch to warning modes, though this reduces security.

Security considerations: Knownhosts helps detect key changes that could indicate tampering, but if the file is tampered with, trust is undermined. If a server’s key legitimately changes, verify it out of band before updating the entry. Hashing improves privacy but makes manual verification harder.