Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 23 Jun 2014 07:31:06 -0800
From: Royce Williams <>
Subject: ssh known_hosts support?

The 'HashKnownHosts' ssh config option enables hashing of IPs and
hostnames in the ~/.known_hosts file.  From the man page:

Indicates that ssh(1) should hash host names and addresses when they
are added to ~/.ssh/known_hosts. These hashed names may be used
normally by ssh(1) and sshd(8), but they do not reveal identifying
information should the file's contents be disclosed. The default is
“no”. Note that existing names and addresses in known hosts files will
not be converted automatically, but may be manually hashed using
ssh-keygen(1). Use of this option may break facilities such as
tab-completion that rely on being able to read unhashed host names
from ~/.ssh/known_hosts.

A brief description of method is at:

The description includes using as an example:


|1|F1E1KeoE/eEWhi10WpGv4OdiO6Y=|3988QV0VE8wmZL7suNrYQLITLCg= ssh-rsa ...

where the first part F1E1KeoE/eEWhi10WpGv4OdiO6Y= is a random salt -
that acts as a key for the HMAC-SHA1 to hash

[ ... snip ... ]

#### key=`echo F1E1KeoE/eEWhi10WpGv4OdiO6Y= | base64 -d | xxd -p`
#### echo -n "" | openssl sha1 -mac HMAC -macopt
hexkey:$key|awk '{print $2}' | xxd -r -p|base64

[end quote]

What would be the best path to using john for this purpose?


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.