In this lesson, you will learn how to enforce a mandatory layer of encryption on your SSH private keys to prevent unauthorized access if your identity files are ever stolen or copied.
The Problem with Unprotected Keys
By default, when you generate an SSH key pair using ssh-keygen, the system provides an option to enter a passphrase. If you leave this blank, your private key resides on your disk in plain text. If an attacker gains read access to your local home directory, they can simply copy your ~/.ssh/id_rsa (or equivalent) and impersonate you on any server where that key is authorized.
Enforcing Encrypted Keys
Hardening requires that every key used for remote access is protected by a strong passphrase. This ensures that even if the physical file is compromised, the attacker still lacks the secret "key to the key."
To verify if your current keys are protected, try to display the content of your key:
cat ~/.ssh/id_ed25519
If you see a block beginning with -----BEGIN OPENSSH PRIVATE KEY----- without an ENCRYPTED label in the header, your key is currently unprotected.
To re-secure an existing key without needing to update the public key on your servers, use the -p flag:
ssh-keygen -p -f ~/.ssh/id_ed25519
This command prompts you for the old passphrase (or just hit enter if there wasn't one) and asks for a new, strong passphrase. This updates the encryption on the file itself without altering the public key fingerprint.
Streamlining with the SSH Agent
A common complaint is that passphrases make authentication cumbersome. To maintain high security without the annoyance of typing your passphrase on every connection, use ssh-agent. When you unlock your key once per session, the agent stores the decrypted key in memory:
eval $(ssh-agent -s)
ssh-add ~/.ssh/id_ed25519
This keeps your local disk storage encrypted at rest while providing seamless, authenticated access for the remainder of your login session.
Key Takeaway: Never store unencrypted SSH private keys on disk; use a strong passphrase and rely on an SSH agent for secure, memory-only access during your session.