> /dev/null .known_hosts
This is not a good idea (and far from "awesome"). I get why he's doing it, but suggesting that weakening the security of a tool that is meant to enhance it is bad advice.
This is not a good idea (and far from "awesome"). I get why he's doing it, but suggesting that weakening the security of a tool that is meant to enhance it is bad advice.
There's just too much that can go wrong.
I understand his specific application, and why it works for him, but including it as advice for the general SSH-consuming public is nuts.
The first things I do with sshd on any machine are 1) disable remote root login and 2) disable password login.
plus move it to a high non-standard port
Our fail2ban processes were using a not-insignificant amount of resources while sshd was listening on port 22. Moving to a high port shifted it to somewhere in the "dead last" range in the CPU time column.
It's host key checking that stops you typing in your root password into a different server that isn't who it says it is.