[openssh-commits] [openssh] 65/87: upstream: make `ssh-keygen -H` (hash a known_hosts file) also

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 0e875c2d75586729a24922d644770aaeefedaedf
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 07:46:41 2026 +0000

    upstream: make `ssh-keygen -H` (hash a known_hosts file) also
    
    strip comments from the output. The intention is to obscure the hostnames and
    so including comments, especially ones that come from ssh-keyscan, totally
    defeats the purpose
    
    Anthropic ANT-2026-KI130WJG
    
    OpenBSD-Commit-ID: 92986fe7d33799f3a4cbbbfbc5f5ea4b284671e1
---
 ssh-keyscan.1 | 8 ++++++--
 ssh-keyscan.c | 5 +++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/ssh-keyscan.1 b/ssh-keyscan.1
index 7446b862f..cc001ae12 100644
--- a/ssh-keyscan.1
+++ b/ssh-keyscan.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ssh-keyscan.1,v 1.54 2026/06/26 06:17:13 djm Exp $
+.\"	$OpenBSD: ssh-keyscan.1,v 1.55 2026/10/30 07:46:41 djm Exp $
 .\"
 .\" Copyright 1995, 1996 by David Mazieres <dm at lcs.mit.edu>.
 .\"
@@ -6,7 +6,7 @@
 .\" permitted provided that due credit is given to the author and the
 .\" OpenBSD project by leaving this copyright notice intact.
 .\"
-.Dd $Mdocdate: June 26 2026 $
+.Dd $Mdocdate: October 30 2026 $
 .Dt SSH-KEYSCAN 1
 .Os
 .Sh NAME
@@ -107,6 +107,10 @@ and
 .Xr sshd 8 ,
 but they do not reveal identifying information should the file's contents
 be disclosed.
+This option also suppresses the comments containing the server host name
+and banner, as if
+.Fl q
+had been specified.
 .It Fl O Ar option
 Specify a key/value option.
 At present, only a single option is supported:
diff --git a/ssh-keyscan.c b/ssh-keyscan.c
index 0fb6e9fef..7ae50a6e9 100644
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keyscan.c,v 1.172 2026/10/30 03:13:52 djm Exp $ */
+/* $OpenBSD: ssh-keyscan.c,v 1.173 2026/10/30 07:46:41 djm Exp $ */
 /*
  * Copyright 1995, 1996 by David Mazieres <dm at lcs.mit.edu>.
  *
@@ -571,7 +571,8 @@ congreet(int s)
 		confree(s);
 		return;
 	}
-	if (!quiet) {
+	/* The comment names the host, which -H promises not to reveal */
+	if (!quiet && !hash_hosts) {
 		fprintf(stdout, "%c %s:%d %s\n", print_sshfp ? ';' : '#',
 		    c->c_name, ssh_port, chop(buf));
 	}

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.