Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am used to version control most of my dot files and push them to a repository on GitHub. I would also like to add ~/.ssh/config to have an up-to-date configuration on all machines.

Could an attacker benefit from having the host names listed in a publicly available ~/.ssh/config?

share|improve this question
1  
Just make sure you don't commit the key files. ;) –  Terry Chia Jul 19 '13 at 15:46

3 Answers 3

up vote 6 down vote accepted

Typically not, but there are certain targeted attack cases where this might be useful. The more likely danger is that you'd accidentally commit some sensitive bit information that you didn't intend to have there.

If you're using github for storing personal files, do yourself (and github) a favor and pay the $7 to get private repos.

share|improve this answer
    
Well the biggest problem I saw was, that some host names are from a corporate private network. Now that you say that with the private repos, that's probably a good advice. –  matthias Jul 20 '13 at 6:27

Having host names only gives a name to an IP. They could just as easily look up DNS records and pull them if they are public.

But in all honestly, a host name shouldn't be a security risk unless you run out of date services on your machines.

Obscurity =/= Security.

share|improve this answer

it could expose the customers/projects you woirk for or with and could give attackers a hint, esp. for spear-phishing.

if you have access to server-resources i'd advise you to use a controlled git-server via gitolite.

i'd NEVER store anything on github/bitbucket that hasnt the lable GPL or OpenSource, even if it is a private repo.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.