Do we have any standard way to encrypt SSH host keys (like /etc/ssh/ssh_host_rsa_key)? If not, why is it stored in plaintext? Isn't it sensitive information?

1 Answer 1


The private part of the host key is needed at sshd startup. It would be inconvenient to require a superuser to input the passphrase every time sshd is started. Obviously, storing the passphrase somewhere and passing it through configs would just move the problem elsewhere.

Private key security relies on filesystem permissions. There's no need to go further, as an attacker with root access to a machine could just create new host keys willy-nilly, overwriting any passphrase-protected keys you have in place.

  • Just to add to Marc's excellent answer - if you have a requirement to encrypt the host keys, then put them in an encrypted filesystem. But do think about how you are going to bring the sshd up (deferred? Use a different key for autostartup?)
    – symcbean
    Commented Dec 27, 2017 at 16:45
  • 1
    It is the same with a webserver and it's private key for the SSL certificate. You can have it encrypted on the harddisk, but then you need to enter the passphrase each time you restart the service.
    – cornelinux
    Commented Dec 27, 2017 at 19:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .