Read host keys from environment variables

[Darren Tucker]

On Tue, 11 Aug 2026 at 22:19, Philipp Marek <philipp at marek.priv.at> wrote:
> > Where would this hostkey environment variable be coming from?
> >
> > It seems like doing this safely would be *extremely* difficult
> >  - Firstly, you would need to ensure that you got rid of the host key
> > from the environment of the parent process and any other process it
> > forked, including those forked before it started sshd.
>
> These things are solved on the container provider side --
> Kubernetes, Openshift, etc.

Given the lack of references or explanations as to why that is
actually the case you will have to forgive me as I remain unconvinced.

[...]
> Well, the environment variable would be inherited by child processes
> by default anyway.

An environment variable that is inherited by the child process is also
generally visible to any other user.  If you're proposing encrypting
the environment variables: in order to do that you also have to have
the decryption keys also available to those child processses in such a
way that is *also* not recoverable by other users.

How do you pass a (private! secret!) host key to the other sshds in a
way that is not recoverable by an arbitrary user on the same system?
Stuffing the host key from the environment into a root-owned host key
file inside the container at startup time seems far less dangerous and
probably works already with a simple shell one-liner.


--
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.