[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+E3k92VbqSt_YFjKW_3L4Kph3OTMryD8G7OShrn3EYRVEMOMw@mail.gmail.com>
Date: Mon, 23 Jun 2014 07:31:06 -0800
From: Royce Williams <royce@...ho.org>
To: john-users@...ts.openwall.com
Subject: ssh known_hosts support?
The 'HashKnownHosts' ssh config option enables hashing of IPs and
hostnames in the ~/.known_hosts file. From the man page:
Indicates that ssh(1) should hash host names and addresses when they
are added to ~/.ssh/known_hosts. These hashed names may be used
normally by ssh(1) and sshd(8), but they do not reveal identifying
information should the file's contents be disclosed. The default is
“no”. Note that existing names and addresses in known hosts files will
not be converted automatically, but may be manually hashed using
ssh-keygen(1). Use of this option may break facilities such as
tab-completion that rely on being able to read unhashed host names
from ~/.ssh/known_hosts.
A brief description of method is at:
http://security.stackexchange.com/questions/56268/ssh-benefits-of-using-hashed-known-hosts/56283#56283
The description includes using 192.168.1.1 as an example:
[quoting]
|1|F1E1KeoE/eEWhi10WpGv4OdiO6Y=|3988QV0VE8wmZL7suNrYQLITLCg= ssh-rsa ...
where the first part F1E1KeoE/eEWhi10WpGv4OdiO6Y= is a random salt -
that acts as a key for the HMAC-SHA1 to hash 192.168.1.61.
[ ... snip ... ]
#### key=`echo F1E1KeoE/eEWhi10WpGv4OdiO6Y= | base64 -d | xxd -p`
#### echo -n "192.168.1.61" | openssl sha1 -mac HMAC -macopt
hexkey:$key|awk '{print $2}' | xxd -r -p|base64
3988QV0VE8wmZL7suNrYQLITLCg=
[end quote]
What would be the best path to using john for this purpose?
Royce
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
