I am used to version control most of my dot files and push them to a repository on GitHub. I would also like to add ~/.ssh/config to have an up-to-date configuration on all machines.

Could an attacker benefit from having the host names listed in a publicly available ~/.ssh/config?

  • 1
    Just make sure you don't commit the key files. ;)
    – user10211
    Jul 19, 2013 at 15:46

3 Answers 3


Typically not, but there are certain targeted attack cases where this might be useful. The more likely danger is that you'd accidentally commit some sensitive bit information that you didn't intend to have there.

If you're using github for storing personal files, do yourself (and github) a favor and pay the $7 to get private repos.

  • Well the biggest problem I saw was, that some host names are from a corporate private network. Now that you say that with the private repos, that's probably a good advice.
    – matthias
    Jul 20, 2013 at 6:27

Having host names only gives a name to an IP. They could just as easily look up DNS records and pull them if they are public.

But in all honestly, a host name shouldn't be a security risk unless you run out of date services on your machines.

Obscurity =/= Security.


it could expose the customers/projects you woirk for or with and could give attackers a hint, esp. for spear-phishing.

if you have access to server-resources i'd advise you to use a controlled git-server via gitolite.

i'd NEVER store anything on github/bitbucket that hasnt the lable GPL or OpenSource, even if it is a private repo.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .