SSH reading "/root/.ssh/known_hosts" from local or remote?

0

I am having issues connecting to a remote server with SSH and I'm trying to understand some output I am seeing from SSH when running a connection with the -vvv switch enabled.

I am running the below command from my project folder...

ssh -i keyfile.pem root@$REMOTE_HOST -vvv

Within the output I see that SSH is reading from "/root/.ssh/known_hosts". This may be a stupid question, but is this being read from the remote host or from the same folder on my box?

I am running as root on Kali (yes I know don't run as root).

OpenSSH_8.0p1 Debian-6, OpenSSL 1.1.1d  10 Sep 2019
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolve_canonicalize: hostname $REMOTE_HOST is address
debug2: ssh_connect_direct
debug1: Connecting to $REMOTE_HOST [$REMOTE_HOST] port 22.
debug1: Connection established.
debug1: identity file key2.pem type -1
debug1: identity file key2.pem-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.0p1 Debian-6
debug1: Remote protocol version 2.0, remote software version OpenSSH_4.3p2 Debian-9
debug1: match: OpenSSH_4.3p2 Debian-9 pat OpenSSH_2*,OpenSSH_3*,OpenSSH_4* compat 0x00000002
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to $REMOTE_HOST:22 as 'root'
debug3: hostkeys_foreach: reading file "/root/.ssh/known_hosts" # HERE
debug3: record_hostkey: found key type RSA in file /root/.ssh/known_hosts:7
debug3: load_hostkeys: loaded 1 keys from $REMOTE_HOST
ssh
debian
asked on Server Fault Oct 23, 2019 by 3therk1ll

1 Answer

1

It is a local read. Ssh needs to check the identity of the server. Each user has its own list of servers.

answered on Server Fault Oct 23, 2019 by Eduardo TrĂ¡pani

User contributions licensed under CC BY-SA 3.0