TIL: Ubuntu 26.04 *still* comes with `HashKnownHosts yes` in /etc/ssh/ssh_config
(I had an interaction a couple of years ago where I was publicly annoyed that OpenSSH would set (I thought) HashKnownHosts by default, and one of the developers went "WTF? No, we don't?" at me, and then we discovered that Ubuntu sets this, which they didn't even know and don't recommend.)
Jul 1, 2026, 11:12 AM@henryk out of curiosity, why is the Ubuntu recommendation to disable HashKnownHosts? On first glance it doesn’t sound like a stupid idea to hash the known hosts entries (e.g. to obfuscate them)… 🤔
@tisba Convenience mostly. You lose tab-completion for host names, for example. Or, in my case, new pubkey and I'd like a convenient directory of hosts to ssh-copy-id to.
On the flip side the security benefits are marginal at best. Knowledge of the host is *not* the security boundary, having the key is the boundary. If hostnames really were secret, one would need to disable bash history too. And maybe other things.
There *may* be circumstances were this is warranted, but it's not everywhere.
Jul 1, 2026, 11:41 AM@henryk oh yes, good points, thank you! missing tab-completion would be quite anyoing.
Thinking about it some more, there are most likely quite a few more places that contain host names. Even some kind of enumeration if probably also feasible. There typically isn't a ton of entropy in hostnames anyway.
@henryk interesting! I didn't find a source for that recommendation. I also like to rather have knowledge of what is in the list. Do you have a source you can reference?
@green_rage "The default is no." is IMHO a good start https://man.openbsd.org/ssh_config#HashKnownHosts
Ubuntu went out of their way to change that.