Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am used to version control most of my dot files and push them to a repository on GitHub. I would also like to add ~/.ssh/config to have an up-to-date configuration on all machines.
Could an attacker benefit from having the host names listed in a publicly available ~/.ssh/config?
Typically not, but there are certain targeted attack cases where this might be useful. The more likely danger is that you'd accidentally commit some sensitive bit information that you didn't intend to have there.
If you're using github for storing personal files, do yourself (and github) a favor and pay the $7 to get private repos.
Having host names only gives a name to an IP. They could just as easily look up DNS records and pull them if they are public.
But in all honestly, a host name shouldn't be a security risk unless you run out of date services on your machines.
Obscurity =/= Security.
it could expose the customers/projects you woirk for or with and could give attackers a hint, esp. for spear-phishing.
if you have access to server-resources i'd advise you to use a controlled git-server via gitolite.
i'd NEVER store anything on github/bitbucket that hasnt the lable GPL or OpenSource, even if it is a private repo.
