Where SSH Keys Are Stored in Linux

This guide shows you where SSH keys and related files live on a Linux system, what each one is for, and the permissions each needs. It is a reference you will come back to when setting up or troubleshooting key-based login.

Last reviewed: 1 August 2026, against the current OpenSSH layout on Ubuntu and Debian.

Your own keys: ~/.ssh/

On the machine you connect from (and on the server for each user), SSH files live in a .ssh directory inside the user’s home directory, written as ~/.ssh/. The ~ means “this user’s home”, so for user sammy it is /home/sammy/.ssh/, and for root it is /root/.ssh/.

File	What it is
~/.ssh/id_ed25519	Your private key. Never share it or copy it anywhere untrusted.
~/.ssh/id_ed25519.pub	Your public key. Safe to share; this is what goes on servers.
~/.ssh/authorized_keys	On a server, the list of public keys allowed to log in as this user. One key per line.
~/.ssh/known_hosts	Server fingerprints your client has accepted, so SSH can warn you if a server changes.
~/.ssh/config	Per-host client settings: aliases, usernames, which key to use.

Older setups use id_rsa / id_rsa.pub instead of id_ed25519; the filenames differ but the roles are the same.

Permissions SSH insists on

SSH refuses to use files whose permissions are too open, because a readable private key is a compromised one. The correct permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
chmod 600 ~/.ssh/authorized_keys

If key login suddenly fails with no other change, wrong permissions on ~/.ssh or authorized_keys are one of the first things to check. The home directory itself must also not be group-writable.

System-wide host keys: /etc/ssh/

The server’s own identity keys live in /etc/ssh/, not in any home directory. These are generated when OpenSSH is installed and are what your client verifies against its known_hosts:

/etc/ssh/ssh_host_ed25519_key      # server private host key
/etc/ssh/ssh_host_ed25519_key.pub  # server public host key

If you reinstall a server, these change, which is why SSH then warns that the “host identification has changed” — the new server no longer matches the fingerprint in your known_hosts.

Quick reference

• Your private key: ~/.ssh/id_ed25519 — keep it secret, on your machine.
• Your public key: ~/.ssh/id_ed25519.pub — copy this to servers.
• Let a key in: add its public key to the server’s ~/.ssh/authorized_keys for that user.
• Server’s identity: /etc/ssh/ssh_host_*.

To put this to use, see How to Set Up SSH Key-Based Authentication on a Linux Server.