[tptacek]

This is fun, but if you cat out your ~/.ssh/known_hosts file, you'll probably find that it's not hashed, and is just coughing up a map of your SSH relationships to anyone who can read it.

It's true though, known_hosts for pivoting is a basic network pentest trick.

[stormbrew]

It's been turned on by default on every ubuntu machine I've used/installed in the last few years. I believe that comes from debian [1].

So I don't think it's that unlikely that any given reader of this has it enabled, tbh.

[1] search for HashKnownHosts here: https://manpages.debian.org/jessie/openssh-client/ssh_config...

[throwaway2048]

Its the default in the openBSD openssh upstream, has been for years and years.

[jwilk]

Is it? https://man.openbsd.org/ssh_config#HashKnownHosts says "The default is no".

[caf]

Maybe stashing a honeypot address in the known_hosts is a good idea?

[tptacek]

It is, and what you're looking for is:

https://canarytokens.org/

[helper]

I don't see ssh as an option there?

[tptacek]

You'd use a DNS canary.

[helper]

Got it. Thanks.