The SSH Key Security Challenge
SSH keys are critical for secure access to servers, cloud infrastructure, and DevOps pipelines. However, SSH key management is often overlooked, creating significant security risks:
- Key sprawl: Thousands of keys across the organization with no visibility
- Orphaned keys: Keys that remain active after employees leave
- No rotation: Keys that have never been rotated since creation
- Shared keys: Multiple users sharing the same private key
- No audit trail: Unknown who has access to what systems
The Impact of Poor SSH Key Management
Security breaches due to compromised SSH keys can result in:
- Unauthorized access to production systems
- Data exfiltration and ransomware deployment
- Compliance violations and audit failures
- Lateral movement across the network
SSH Key Lifecycle Phases
1. Key Discovery
The first step is identifying all SSH keys in your environment:
User Keys
- Developer workstations
- Admin jump hosts
- CI/CD systems
- Automation servers
Host Keys
- Server SSH host keys
- Network device keys
- Cloud instance keys
- Container environment keys
Authorized Keys
- ~/.ssh/authorized_keys on all systems
- System-wide authorized keys files
- Keys in configuration management
2. Key Inventory
Build a comprehensive inventory including:
- Key fingerprint and algorithm
- Creation date (if known)
- Last usage date
- Associated user or system
- Authorized access targets
- Key strength and compliance status
3. Key Provisioning
Implement controlled key provisioning:
bash1# Generate secure SSH key 2ssh-keygen -t ed25519 -C "[email protected]" -f ~/.ssh/id_ed25519 3 4# For legacy compatibility (RSA) 5ssh-keygen -t rsa -b 4096 -C "[email protected]" -f ~/.ssh/id_rsa
Best practices for provisioning:
- Use strong algorithms (Ed25519 or RSA 4096-bit)
- Require passphrase protection
- Issue keys through centralized system
- Document purpose and authorization
4. Key Rotation
Regular key rotation is essential:
Rotation Triggers
- Scheduled rotation (e.g., every 90 days)
- Personnel changes
- Security incidents
- Compliance requirements
Rotation Process
- Generate new key pair
- Deploy new public key to authorized systems
- Verify access with new key
- Remove old public key from all systems
- Securely destroy old private key
5. Key Revocation
Immediate revocation capabilities for:
- Employee termination
- Key compromise
- Policy violations
- System decommissioning
Enterprise SSH Key Management
Centralized Key Authority
Implement centralized control:
- Single source of truth for all SSH keys
- Approval workflows for key requests
- Automated provisioning and revocation
- Integration with identity providers
Certificate-Based SSH
Consider SSH certificates for enhanced management:
bash1# Create CA key 2ssh-keygen -t ed25519 -f ssh_ca -C "SSH Certificate Authority" 3 4# Sign user key with CA 5ssh-keygen -s ssh_ca -I user@company -n username -V +52w id_ed25519.pub
Benefits of SSH certificates:
- Built-in expiration dates
- Centralized revocation
- No authorized_keys management
- Flexible principal assignment
Integration with Identity Systems
Connect SSH key management with:
- Active Directory / LDAP
- SSO providers (Okta, Azure AD)
- PAM solutions (CyberArk, HashiCorp Vault)
- HR systems for lifecycle events
Automation and Policy Enforcement
Automated Discovery
Continuous scanning for SSH keys:
python1def scan_authorized_keys(hosts): 2 """Scan hosts for SSH authorized keys""" 3 results = [] 4 5 for host in hosts: 6 keys = ssh_exec(host, 'cat ~/.ssh/authorized_keys') 7 for key in parse_ssh_keys(keys): 8 results.append({ 9 'host': host, 10 'fingerprint': key.fingerprint, 11 'type': key.key_type, 12 'comment': key.comment 13 }) 14 15 return results
Policy Enforcement
Implement and enforce policies:
- Key strength requirements: Minimum RSA 2048, prefer Ed25519
- Maximum key age: Force rotation after defined period
- Access scope limits: Restrict which systems keys can access
- Usage monitoring: Alert on unusual key usage patterns
Compliance Reporting
Generate reports for:
- Key inventory and age distribution
- Keys without recent rotation
- Orphaned keys (no matching user)
- Non-compliant key algorithms
- Access pattern analysis
SSH Key Management Architecture
Components
- Key Discovery Scanner: Continuous inventory of keys across infrastructure
- Key Vault: Secure storage for private keys (when centrally managed)
- Policy Engine: Enforce organizational key policies
- Provisioning Service: Automate key generation and deployment
- Integration Layer: Connect with identity providers and ITSM
Deployment Options
Agentless
- API-based discovery via SSH
- Scheduled scanning from central system
- Limited real-time visibility
Agent-Based
- Deploy lightweight agents to hosts
- Real-time monitoring and enforcement
- Better visibility and control
Hybrid
- Agents for critical systems
- Agentless for broader coverage
- Balance of visibility and complexity
Best Practices Summary
Key Generation
- Use Ed25519 or RSA 4096-bit keys
- Always protect private keys with strong passphrases
- Generate keys on secure, trusted systems
Key Distribution
- Never share private keys
- Use secure channels for public key distribution
- Automate key deployment through configuration management
Access Control
- Implement least privilege for SSH access
- Regular access reviews and certification
- Immediate revocation for terminated users
Monitoring and Auditing
- Log all SSH authentication events
- Alert on failed authentication attempts
- Regular review of key usage patterns
Conclusion
SSH key lifecycle management is critical for enterprise security. Organizations must implement comprehensive discovery, centralized management, and automated rotation to protect against SSH key-related security risks.
TigerTrust provides enterprise SSH key management as part of our machine identity platform, including automated discovery, centralized control, and policy-based lifecycle management.