14

Below is an known_hosts entry. The part that starts with ssh-rsa and goes to the end is a public key. What are the other parts (the characters before ssh-rsa)?

|1|KnbIIJIPrL/1p7ofUV74sK+j/Gc=|wrjOFnPgoF0afgH0PeRtRqSdgvc= ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==

Emanuil Rusev
  • 901
  • 3
  • 10
  • 16

2 Answers2

22

The |1| is the HASH_MAGIC, indicating that it is a hashed known_hosts entry.

The next two base-64 encoded fields (delimited by |) are the randomly-generated salt and the SHA-1 hash of the host.

If you are using an older version of OpenSSH, or if you have HashKnownHosts No set in your /etc/ssh/ssh_config or ~/.ssh/config`, the entries are not hashed and look more like this:

remotehostname,192.168.1.100 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdn...etc...
Cakemox
  • 25,209
  • 6
  • 44
  • 67
  • This information about the HASH_MAGIC and salt and SHA-1 hash is not present in the Ubuntu manpage. Any source? – Milind R Nov 29 '21 at 13:02
  • What is the salt used for? Is the hashing done for security reasons? – jarno Nov 06 '22 at 09:32
  • For some reason I could not get a matching hash of the host by `echo remotehostname | sha1sum | xxd -r -p | base64` in Linux. – jarno Nov 06 '22 at 09:41
8

From the sshd(8) man page, SSH_KNOWN_HOSTS FILE FORMAT section:

 Each line in these files contains the following fields: markers
 (optional), hostnames, bits, exponent, modulus, comment.  The fields are
 separated by spaces.

...

 Alternately, hostnames may be stored in a hashed form which hides host
 names and addresses should the file’s contents be disclosed.  Hashed
 hostnames start with a ‘|’ character.  Only one hashed hostname may
 appear on a single line and none of the above negation or wildcard opera-
 tors may be applied.
Ignacio Vazquez-Abrams
  • 45,939
  • 6
  • 79
  • 84
  • I see "Each line in these files contains the following fields: markers (optional), hostnames, keytype, base64-encoded key, comment. The fields are separated by spaces." – William Entriken Apr 27 '21 at 19:53