SSH-KEYSIGN(8)

💖 SSH-KEYSIGN(8) 💖

okay bestie, so this is the ssh-keysign page from the System Manager's Manual — it's an OpenSSH thing and honestly? lowkey iconic. let's get into it 🫶

---

✨ NAME ✨

ssh-keysign — OpenSSH helper for host-based authentication

---

✨ SYNOPSIS ✨

ssh-keysign

that's it. that's the whole vibe. no flags, no args, nothing. she just exists 💅

---

✨ DESCRIPTION ✨

so ssh-keysign is the little helper that ssh(1) calls up when it needs to reach the local host keys and cook up the digital signature that host-based authentication requires. it's giving backstage crew energy — you never see her, but the show doesn't happen without her 🌟

heads up: ssh-keysign is disabled by default fr fr. the only way to turn her on is in the global client configuration file /etc/gsissh/ssh_config, by setting EnableSSHKeysign to “yes”.

also, and this is important — ssh-keysign is not meant to be run by you. like, at all. she gets invoked by ssh(1), not by a human. if you wanna know more about host-based authentication, go read ssh(1) and sshd(8). they have the lore 📚

---

✨ FILES ✨

• /etc/gsissh/ssh_config — this is the file that controls whether ssh-keysign is enabled. the switch, the whole vibe check 🎀
• /etc/gsissh/ssh_host_ecdsa_key
• /etc/gsissh/ssh_host_ed25519_key
• /etc/gsissh/ssh_host_rsa_key — these three hold the private parts of the host keys that get used to generate the digital signature. they should be owned by root, readable only by root, and not accessible to anybody else. and because they're root-only, ssh-keysign has to be set-uid root if host-based authentication is gonna be used. no set-uid, no signature, no slay 😭
• /etc/gsissh/ssh_host_ecdsa_key-cert.pub
• /etc/gsissh/ssh_host_ed25519_key-cert.pub
• /etc/gsissh/ssh_host_rsa_key-cert.pub — if these exist, they're assumed to contain public certificate information that corresponds with the private keys above. so like, if they're there, they're there for a reason 🦋

---

✨ SEE ALSO ✨

ssh(1), ssh-keygen(1), ssh_config(5), sshd(8)

go read them, they're all part of the same friend group 🌈

---

✨ HISTORY ✨

ssh-keysign first appeared in OpenBSD 3.2. she's been around a minute, ngl — a true veteran 💜

---

✨ AUTHORS ✨

Markus Friedl <markus@openbsd.org>

---

and that's the whole page, bestie!! 💖 this one came from the Debian build of the manual, dated June 17, 2024, and it's filed under SSH-KEYSIGN(8). go forth and authenticate, you main character 👑✨