---
title: "Where SSH Keys Are Stored in Linux"
description: "Where SSH keys live on a Linux system: your own keys in ~/.ssh, the server's authorized_keys and known_hosts, the system host keys, and the permissions each needs."
url: "https://docs.noiz.ie/linux/where-ssh-keys-are-stored-in-linux/"
section: "How to Linux"
categories:
  - "Server Administration > Linux Basics > SSH"
tags:
  - "ssh"
  - "linux"
  - "keys"
  - "security"
last_reviewed: "1 August 2026, against the current OpenSSH layout on Ubuntu and Debian"
---

# Where SSH Keys Are Stored in Linux

This guide shows you where SSH keys and related files live on a Linux system, what each one is for, and the permissions each needs. It is a reference you will come back to when setting up or troubleshooting key-based login.

**Last reviewed:** 1 August 2026, against the current OpenSSH layout on Ubuntu and Debian.

## Your own keys: `~/.ssh/`

On the machine you connect **from** (and on the server for each user), SSH files live in a `.ssh` directory inside the user's home directory, written as `~/.ssh/`. The `~` means "this user's home", so for user `sammy` it is `/home/sammy/.ssh/`, and for root it is `/root/.ssh/`.

| File | What it is |
|---|---|
| `~/.ssh/id_ed25519` | Your **private key**. Never share it or copy it anywhere untrusted. |
| `~/.ssh/id_ed25519.pub` | Your **public key**. Safe to share; this is what goes on servers. |
| `~/.ssh/authorized_keys` | On a **server**, the list of public keys allowed to log in as this user. One key per line. |
| `~/.ssh/known_hosts` | Server fingerprints your client has accepted, so SSH can warn you if a server changes. |
| `~/.ssh/config` | Per-host client settings: aliases, usernames, which key to use. |

Older setups use `id_rsa` / `id_rsa.pub` instead of `id_ed25519`; the filenames differ but the roles are the same.

## Permissions SSH insists on

SSH refuses to use files whose permissions are too open, because a readable private key is a compromised one. The correct permissions:

```bash
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
chmod 600 ~/.ssh/authorized_keys
```

If key login suddenly fails with no other change, wrong permissions on `~/.ssh` or `authorized_keys` are one of the first things to check. The home directory itself must also not be group-writable.

## System-wide host keys: `/etc/ssh/`

The **server's own** identity keys live in `/etc/ssh/`, not in any home directory. These are generated when OpenSSH is installed and are what your client verifies against its `known_hosts`:

```
/etc/ssh/ssh_host_ed25519_key      # server private host key
/etc/ssh/ssh_host_ed25519_key.pub  # server public host key
```

If you reinstall a server, these change, which is why SSH then warns that the "host identification has changed": the new server no longer matches the fingerprint in your `known_hosts`.

## Quick reference

- **Your private key:** `~/.ssh/id_ed25519`: keep it secret, on your machine.
- **Your public key:** `~/.ssh/id_ed25519.pub`: copy this to servers.
- **Let a key in:** add its public key to the server's `~/.ssh/authorized_keys` for that user.
- **Server's identity:** `/etc/ssh/ssh_host_*`.

To put this to use, see [How to Set Up SSH Key-Based Authentication on a Linux Server](/linux/how-to-set-up-ssh-key-based-authentication-on-a-linux-server/).

---
Source: https://docs.noiz.ie/linux/where-ssh-keys-are-stored-in-linux/