# Passing SSH Keys securely

**URL:** <https://forums.balena.io/t/passing-ssh-keys-securely/3355>\
**Category:** Product support\
**Created:** [June 20, 2018, 11:01am UTC](https://forums.balena.io/t/passing-ssh-keys-securely/3355 "2018-06-20T11:01:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ionita](https://avatars.discourse-cdn.com/v4/letter/i/c2a13f/32.png) [@ionita](https://forums.balena.io/u/ionita)\
**Post date:** [June 20, 2018, 11:01am UTC](https://forums.balena.io/t/passing-ssh-keys-securely/3355/1 "2018-06-20T11:01:49Z")

</div>

Hi, I am using an SSH key inside a service to connect to a server.  
Right now, I am saving the file in the Git repository. Even though the repository is currently private, I am uneasy about the file lying there. Is there some better way to do this?

Perhaps passing the key through a resin environment variable?

---

<div class="post-metadata">

**Author:** ![chrischabot](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/chrischabot/32/871_2.png) [@chrischabot](https://forums.balena.io/u/chrischabot)\
**Post date:** [June 20, 2018, 11:11am UTC](https://forums.balena.io/t/passing-ssh-keys-securely/3355/3 "2018-06-20T11:11:44Z")

</div>

Hi @ionita, I tend to use env variables for these kind of things. You could implement that by adding the content of the SSH key in your application’s (or device’s) environmental variables:

 ![58](https://global.discourse-cdn.com/balena/original/2X/2/27d19a4235ac6c1763d4f9788a33b22d29eba773.png)

And then either use that directly in your script (in NodeJS that would be process.env.SSH\_KEY for instance), or by creating the ssh key file from your startup script (often called start.sh or entry.sh) by doing something like:

```auto
if [! -f /root/.ssh/id_rsa] ; then
	echo $SSH_KEY > /root/.ssh/id_rsa 
fi
``

Hope that helps!
```

---

<div class="post-metadata">

**Author:** ![ionita](https://avatars.discourse-cdn.com/v4/letter/i/c2a13f/32.png) [@ionita](https://forums.balena.io/u/ionita)\
**Post date:** [June 21, 2018, 11:15am UTC](https://forums.balena.io/t/passing-ssh-keys-securely/3355/4 "2018-06-21T11:15:59Z")

</div>

Hi @chrischabot, thanks for the suggestion and explanation! This would clearly work.

Over here we haven’t made up our minds what to use yet. We came up with two other options.

We were also considering writing the key on the resin OS image before flashing it on the devices’ SD cards. Afterwards this should be accessible from within the container (perhaps with dbus). If this works, I think it would be more secure but a bit of a hack.

Yet another option would be generating a different pair of ssh keys with the server on each device. Sending the public key to the server would then be prone to man-in-the-middle attacks, I guess.

---

<div class="post-metadata">

**Author:** ![chrischabot](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/chrischabot/32/871_2.png) [@chrischabot](https://forums.balena.io/u/chrischabot)\
**Post date:** [June 21, 2018, 11:21am UTC](https://forums.balena.io/t/passing-ssh-keys-securely/3355/6 "2018-06-21T11:21:28Z")

</div>

@ionita that would certainly work – You can even preload the application container to the image at that time to skip the initial download, we’ve documented that at: [https://resin.io/blog/advanced-device-provisioning-workflow-for-large-fleets-preloading-and-pre-provisioning/](https://resin.io/blog/advanced-device-provisioning-workflow-for-large-fleets-preloading-and-pre-provisioning/)

Let us know what solution you end up with or what else we can do to help!