When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has multiple IPs.

What I don't understand is why SSH needs to record the hostname in known_hosts. When I use my private key to authenticate myself to GitHub, there is no need for me to present an IP/domain name to GitHub. Why cant' SSH authenticate the server as original with only its key?

  • It's a key value pair. There can be many. – Andrew Hoffman Sep 21 '14 at 14:38

Let's say that you have hypothetical known_hosting_keys entries for both nsa.gov and github.com.

Now evil.net both infiltrates github.com and also obtains MITM-level control over your internet connection/DNS.

Now you ssh into nsa.gov, and evil.net presents you with stolen github.com credentials, and your ssh client cycles through your known_hosting_keys until it finds one that matches and accepts the connection.

Now you are connected to evil.net thinking it is nsa.gov because of a breach at a 3rd party.

Perhaps this is a risk you are willing to take, but it is not one the designers of ssh were.

My own known_hosts file specifies github.com by name, in addition to by IP address, and I've never had the problem you describe. Unless I intentionally change the file to cause the problem.


I think the other answers here are correct answers to a simpler version of the OP's question, but miss a certain subtlety in the question. SSH is frequently described as implementing public key cryptography schemes as its authentication method, but the OP has noticed that this is not strictly so. Rather, there is an additional layer of security in the SSH suite which depends on the hostname resolution system.

Although it was probably a good design choice for SSH, it has a couple of small unfortunate side effects. Namely:

  1. It might appear to the casual user that the additional layer of security somehow uses public key cryptography to authenticate the domain name association (i.e. the integrity of the DNS system in the given case) in addition to the client itself. These users will have a false sense of security.

  2. It might appear to the smart but uninitiated user (e.g. possibly the OP) that the public key crytography scheme is being bypassed when the user agrees to continue connecting to a host whose authenticity apparently "could not be established". These users will have a false sense of insecurity.

What is being bypassed in (2) is only the additional layer of security, on top of the public key cryptography scheme, related to hostname resolution.


The whole point in having a known_hosts is to keep a record of keys associated with the host they belong to. To be more specifically, it records the key associated with the hostname you tried to connect to with the ssh, scp or sftp command. It will help you avoid MITM attacks, since any SSH-based command will alert you if the server key has changed since it recorded it in your known_hosts.

As long as you use the same hostname and it presents the same key, it does not matter if it has multiple IP or not.

  • This does not answer my question at all. I am specifically asking why a hostname is needed. Only the right host knows the private key, right? Why do I care about the hostname, as long as the key matches? – Siyuan Ren Sep 21 '14 at 13:07
  • SSH allows you to connect to any site. How would SSH know whose key should be matching then? If not storing which key corresponds to which host, every time you had a mismatch with your known hosts, how would you know it is because it is a new site, a MITM attack or your file got corrupted? – NuTTyX Sep 21 '14 at 13:10
  • It can simply match the key presented by the server against a known keys of hosts, just like how the server authenticate the client by searching the authorized_keys file. – Siyuan Ren Sep 21 '14 at 13:13
  • 1
    When you present a private key as an authentication method, you are presenting a username which it belongs to. In any case, in SSH there is no "issuer" neither a "hostname" as in certificates. You must trust it and keep a record of it in case it changes. My known_hosts has over 200 entries. How would I know if any of the servers I'm connecting to has been exposed, they've changed their keys, it is a new server, or my file got corrupted if I do not keep a list of which sites I'm connecting to? And what if any of those servers got the key of another one? – NuTTyX Sep 21 '14 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.