Read host keys from environment variables

[Darren Tucker]

On Tue, 11 Aug 2026 at 20:21, Philipp Marek <philipp at marek.priv.at> wrote:
[...]
> > You *could* probably pick the keys out of memory with a debugger
> > (they're encrypted to mitigate rowhammer-style recovery attacks but a
> > root-equivalent user could defeat that pretty easily).  That said, if
> > you are in a position to do that to ssh-agent, you could just as
> > easily do that to sshd itself.
>
> Hmmm, host-keys in environment variables should do something similar
> then,
> which makes the patch larger than +-10 lines ;/

Where would this hostkey environment variable be coming from?

It seems like doing this safely would be *extremely* difficult
 - Firstly, you would need to ensure that you got rid of the host key
from the environment of the parent process and any other process it
forked, including those forked before it started sshd.
 - Secondly, you would need to somehow make it available to the copy
of sshd that get re-exec'ed on each new connection, in such a way that
it was not also trivially recoverable by someone else.  (See
https://github.com/openssh/openssh-portable/blob/master/README.privsep)
to see what might be involved)


--
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.