When a keypair is created for a normal user, there is an option to symmetrically encrypt the private key with 3DES. I usually believe this to be a good idea, then even if the key is stolen, it will be useless to the attacker.

I've noticed that on each machine (Ubuntu-based, at least) that is running sshd, the private key file that is generated when the sshd server software is installed /etc/ssh/ssh_host_rsa_key is not encrypted with 3DES. Is it possible to force sshd to use an encrypted key, without encrypting the whole disk?

I think of it as similar to the way Apache-over-ssl uses keys. If it's encrypted, every time apache is run, the password must be entered to decrypt the private key. Does sshd have a similar capability?

migrated from superuser.com Nov 4 '11 at 21:16

This question came from our site for computer enthusiasts and power users.

  • Do you really want to start sshd manually from a local console when restarting the server, since you wouldn't be able to ssh in? – Daniel Beck Nov 4 '11 at 20:19
  • Yes, yes I do.... – Jason Nov 4 '11 at 20:23
  • 2
    The sshd server key is used to enable clients to authenticate to the server. If you think folks can get root access to the server (thus the need to keep the key encrypted while on disk) should you not be worried about the key being slurped from the sshd process itself by said root user? – Ram Nov 4 '11 at 21:21

It won't help. The only way someone could steal the key from the file is if they got root access. If they got root access, they could replace sshd with one that logged the decryption password or they could read the key out of the running sshd process' memory.

So either way, someone who gets root access could easily obtain the private key. You would need either a physical hardware device to hold the key or a distinct secure machine to hold it. You can't do it and still process the key in software on the same machine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy