etcsshsshknownhosts

etcsshsshknownhosts refers to the system-wide SSH known_hosts file used by OpenSSH to maintain public keys of remote hosts. On most Unix-like systems it resides at /etc/ssh/ssh_known_hosts and complements the per-user file at ~/.ssh/known_hosts. Together these files enable SSH clients to verify host identities automatically, with the system file providing a centralized registry suitable for multi-user environments or managed deployments.

The file’s format is a line-based key registry. Each non-comment line contains a host name or pattern (potentially multiple names separated by commas), a key type (such as ssh-rsa or ssh-ed25519), and a base64-encoded host public key, optionally followed by a comment. Lines may begin with special directives that modify how the key is treated; for example, entries may indicate a certification authority or other verification rules. Hostnames can be stored in plain text or hashed to protect privacy in shared environments.

Usage and purpose: When an SSH client connects to a host, it checks both the user’s known_hosts file and the system-wide ssh_known_hosts file to verify the host’s key. If a host key is missing or differs from the stored key, the client typically prompts the user for confirmation, or relies on automated trust policies in managed environments. A pre-populated system file is common in enterprise or server distributions to support non-interactive deployments and standard trust baselines.

Management and security: Administrators populate or update this file through secure procedures, such as automated provisioning, ssh-keyscan, or deployment tools. The file is usually owned by root and readable by all users but writable only by root. Proper protection helps prevent man-in-the-middle attacks and ensures consistent host verification across systems.

See also: OpenSSH, known_hosts, ssh-keyscan.