SSH Key Lifecycle Management: Enterprise Security Guide

The SSH Key Security Challenge

SSH keys are critical for secure access to servers, cloud infrastructure, and DevOps pipelines. However, SSH key management is often overlooked, creating significant security risks:

• Key sprawl: Thousands of keys across the organization with no visibility
• Orphaned keys: Keys that remain active after employees leave
• No rotation: Keys that have never been rotated since creation
• Shared keys: Multiple users sharing the same private key
• No audit trail: Unknown who has access to what systems

The Impact of Poor SSH Key Management

Security breaches due to compromised SSH keys can result in:

• Unauthorized access to production systems
• Data exfiltration and ransomware deployment
• Compliance violations and audit failures
• Lateral movement across the network

SSH Key Lifecycle Phases

1. Key Discovery

The first step is identifying all SSH keys in your environment:

User Keys

• Developer workstations
• Admin jump hosts
• CI/CD systems
• Automation servers

Host Keys

• Server SSH host keys
• Network device keys
• Cloud instance keys
• Container environment keys

Authorized Keys

• ~/.ssh/authorized_keys on all systems
• System-wide authorized keys files
• Keys in configuration management

2. Key Inventory

Build a comprehensive inventory including:

• Key fingerprint and algorithm
• Creation date (if known)
• Last usage date
• Associated user or system
• Authorized access targets
• Key strength and compliance status

3. Key Provisioning

Implement controlled key provisioning:

# Generate secure SSH key
ssh-keygen -t ed25519 -C "[email protected]" -f ~/.ssh/id_ed25519

# For legacy compatibility (RSA)
ssh-keygen -t rsa -b 4096 -C "[email protected]" -f ~/.ssh/id_rsa

Best practices for provisioning:

• Use strong algorithms (Ed25519 or RSA 4096-bit)
• Require passphrase protection
• Issue keys through centralized system
• Document purpose and authorization

4. Key Rotation

Regular key rotation is essential:

Rotation Triggers

• Scheduled rotation (e.g., every 90 days)
• Personnel changes
• Security incidents
• Compliance requirements

Rotation Process

1. Generate new key pair
2. Deploy new public key to authorized systems
3. Verify access with new key
4. Remove old public key from all systems
5. Securely destroy old private key

5. Key Revocation

Immediate revocation capabilities for:

• Employee termination
• Key compromise
• Policy violations
• System decommissioning

Enterprise SSH Key Management

Centralized Key Authority

Implement centralized control:

• Single source of truth for all SSH keys
• Approval workflows for key requests
• Automated provisioning and revocation
• Integration with identity providers

Certificate-Based SSH

Consider SSH certificates for enhanced management:

# Create CA key
ssh-keygen -t ed25519 -f ssh_ca -C "SSH Certificate Authority"

# Sign user key with CA
ssh-keygen -s ssh_ca -I user@company -n username -V +52w id_ed25519.pub

Benefits of SSH certificates:

• Built-in expiration dates
• Centralized revocation
• No authorized_keys management
• Flexible principal assignment

Integration with Identity Systems

Connect SSH key management with:

• Active Directory / LDAP
• SSO providers (Okta, Azure AD)
• PAM solutions (CyberArk, HashiCorp Vault)
• HR systems for lifecycle events

Automation and Policy Enforcement

Automated Discovery

Continuous scanning for SSH keys:

def scan_authorized_keys(hosts):
    """Scan hosts for SSH authorized keys"""
    results = []

    for host in hosts:
        keys = ssh_exec(host, 'cat ~/.ssh/authorized_keys')
        for key in parse_ssh_keys(keys):
            results.append({
                'host': host,
                'fingerprint': key.fingerprint,
                'type': key.key_type,
                'comment': key.comment
            })

    return results

Policy Enforcement

Implement and enforce policies:

• Key strength requirements: Minimum RSA 2048, prefer Ed25519
• Maximum key age: Force rotation after defined period
• Access scope limits: Restrict which systems keys can access
• Usage monitoring: Alert on unusual key usage patterns

Compliance Reporting

Generate reports for:

• Key inventory and age distribution
• Keys without recent rotation
• Orphaned keys (no matching user)
• Non-compliant key algorithms
• Access pattern analysis

SSH Key Management Architecture

Components

1. Key Discovery Scanner: Continuous inventory of keys across infrastructure
2. Key Vault: Secure storage for private keys (when centrally managed)
3. Policy Engine: Enforce organizational key policies
4. Provisioning Service: Automate key generation and deployment
5. Integration Layer: Connect with identity providers and ITSM

Deployment Options

Agentless

• API-based discovery via SSH
• Scheduled scanning from central system
• Limited real-time visibility

Agent-Based

• Deploy lightweight agents to hosts
• Real-time monitoring and enforcement
• Better visibility and control

Hybrid

• Agents for critical systems
• Agentless for broader coverage
• Balance of visibility and complexity

Best Practices Summary

Key Generation

• Use Ed25519 or RSA 4096-bit keys
• Always protect private keys with strong passphrases
• Generate keys on secure, trusted systems

Key Distribution

• Never share private keys
• Use secure channels for public key distribution
• Automate key deployment through configuration management

Access Control

• Implement least privilege for SSH access
• Regular access reviews and certification
• Immediate revocation for terminated users

Monitoring and Auditing

• Log all SSH authentication events
• Alert on failed authentication attempts
• Regular review of key usage patterns

Conclusion

SSH key lifecycle management is critical for enterprise security. Organizations must implement comprehensive discovery, centralized management, and automated rotation to protect against SSH key-related security risks.

TigerTrust provides enterprise SSH key management as part of our machine identity platform, including automated discovery, centralized control, and policy-based lifecycle management.