[arch-general] Any way to decrypt hashes set by ssh HashKnownHosts?

[David Rosenstrauch]

Aaron Griffin wrote:
>> Anyone know if there's any way to decrypt the hashes created by the
>> HashKnownHosts setting?
> 
> I think the whole point is that they *are* one way hashes. The only
> think I can think of is to find the algorithm they use (sha1?) and
> hash the hostnames that you know, then compare.
> 
> Alternatively, just remove those two and if you get the "(yes/no)"
> prompt you know that's the host 8)

That's kinda what I thought.  Although, one of the hostname strings had 
an "=" at the end, so I was wondering if it might just have been 
something base64-oriented.

Unfortunately I have no idea what machines they are.  They're not 
machines that I use often (e.g., my home server, or my hosting isp), and 
since they're at the bottom of the known_hosts file (and have been 
hashed, which I think is a fairly recent setting change for Arch's 
openssh package) I assume they've been added recently.  So I'm guessing 
they're machines here on our work network, and I'd like to know which 
ones.  I can't think of any new machines I've SSH'ed into lately, though.

Ah well.  I deleted them from the known_hosts, and turned HashKnownHosts 
off for now, and I guess I'll just pay close attention the next time SSH 
asks me about a new host.

Thanks,

DR