SSH-KEYSIGN(8)

📦
version 10.6p1 · 4 versions
, in arch rolling, nixos 26.05, nixpkgs unstable, ubuntu stonking

💖 SSH-KEYSIGN(8) 💖

okay bestie, welcome to the System Manager's Manual page for ssh-keysign, and honestly? she's a little diva who does NOT want to be perceived. let's get into it 🎀

✨ NAME ✨

ssh-keysign — the OpenSSH helper for host-based authentication 🫶

✨ SYNOPSIS ✨

ssh-keysign

that's it. that's the whole synopsis. no flags, no arguments, nothing. she just exists 💅

✨ DESCRIPTION ✨

so here's the tea: ssh-keysign is the lil helper that ssh(1) calls up when it needs to get at the local host keys and generate the digital signature required during host-based authentication. think of her as the backstage crew — you never see her, but the show literally cannot go on without her. 👑

and here's the important part, no cap: ssh-keysign is disabled by default. the only way to turn her on is in the global client config file /etc/ssh/ssh_config, by setting EnableSSHKeysign to “yes”. that's it. that's the switch. 🔥

also, she is not meant to be invoked by you, the user. like, at all. she gets called by ssh(1), from the inside, and that's the vibe. if you wanna know more about host-based authentication, go read ssh(1) and sshd(8) — they've got the full lore. 📚

not me gatekeeping a binary from you but fr fr, don't run this by hand.

✨ FILES ✨

/etc/ssh/ssh_config

controls whether ssh-keysign is enabled. that's the on/off switch, bestie. 🎚️

/etc/ssh/ssh_host_ecdsa_key , /etc/ssh/ssh_host_ed25519_key , /etc/ssh/ssh_host_mldsa44_ed25519_key , /etc/ssh/ssh_host_rsa_key

these files hold the private parts of the host keys that get used to generate the digital signature. and listen: they should be owned by root, readable only by root, and not accessible to others. periodt. 🔒

and because they're readable only by root, ssh-keysign must be set-uid root if host-based authentication is used. like, that's the whole reason she's got the extra privileges, iykyk.

/etc/ssh/ssh_host_ecdsa_key-cert.pub , /etc/ssh/ssh_host_ed25519_key-cert.pub , /etc/ssh/ssh_host_mldsa44_ed25519_key-cert.pub , /etc/ssh/ssh_host_rsa_key-cert.pub

if these files exist, they're assumed to contain public certificate information that corresponds with the private keys listed above. matching set, cute. 🎀

✨ SEE ALSO ✨

✨ HISTORY ✨

ssh-keysign first appeared in OpenBSD 3.2. an icon, a legend, and she is the moment. ⭐

✨ AUTHORS ✨

Markus Friedl <markus@openbsd.org> — thank you for your service king 🫡💖

okay that's the whole page! this one came from Debian and it's dated July 10, 2026. go forth, use host-based auth responsibly, and don't touch other people's host keys bestie 💜🦋✨

📦 where this page comes from