Read host keys from environment variables

Philipp Marek philipp at marek.priv.at
Tue Aug 11 22:19:48 AEST 2026


> Where would this hostkey environment variable be coming from?
> 
> It seems like doing this safely would be *extremely* difficult
>  - Firstly, you would need to ensure that you got rid of the host key
> from the environment of the parent process and any other process it
> forked, including those forked before it started sshd.

These things are solved on the container provider side --
Kubernetes, Openshift, etc.


>  - Secondly, you would need to somehow make it available to the copy
> of sshd that get re-exec'ed on each new connection, in such a way that
> it was not also trivially recoverable by someone else.  (See
> https://github.com/openssh/openssh-portable/blob/master/README.privsep)
> to see what might be involved)

Well, the environment variable would be inherited by child processes
by default anyway.
Finding all the right points in time to get rid of it might be tricky, 
though.


More information about the openssh-unix-dev mailing list