Hash Host Names in the SSH known_hosts File

A stolen known_hosts file lists every machine you connect to, and you want the names unreadable.

ssh-keygen -q -t ed25519 -N '' -f hostkey
key=$(cut -d' ' -f1,2 hostkey.pub)
printf 'web.example.com,192.0.2.10 %s\n' "$key" > known_hosts
ssh-keygen -H -f known_hosts
cut -d' ' -f1 known_hosts | cut -c1-20
ssh-keygen -F web.example.com -f known_hosts | head -n 1
ssh-keygen -F 192.0.2.10 -f known_hosts | head -n 1

WARNING: known_hosts.old contains unhashed entries
Delete this file to ensure privacy of hostnames
known_hosts updated.
Original contents retained as known_hosts.old
|1|mSp0OgzjRwVf0ZkZ6
|1|KdyNP094p+z8lL0Nv
# Host web.example.com found: line 1
# Host 192.0.2.10 found: line 2

ssh-keygen -H rewrites each host field into a salted hash that starts with |1|, so the names cannot be read back from the file. Lookups still work, because ssh hashes the name it is looking for with the stored salt, and the run's last two lines show both the host name and its IP address found. The command warns that the old file still has the names. See ssh-keygen and the HashKnownHosts option in ssh_config.

Hashing hides names from a casual reader and not from someone who can guess them, since a hash of a likely host name is easy to check. Delete the .old copy, or the effort is wasted. HashKnownHosts yes in the config hashes only the entries added from then on. Hashed files are harder to edit by hand.