How do you revoke and rotate SSH keys when needed?

SSH keys are cryptographic pairs of public and private keys that enable secure and authenticated access to remote servers. They are often used to automate tasks, transfer files, or log in without passwords. However, SSH keys can also pose security risks if they are compromised, lost, or misused. Therefore, it is important to revoke and rotate SSH keys when needed, such as when an employee leaves, a device is stolen, or a breach is detected. In this article, you will learn how to revoke and rotate SSH keys using some common tools and best practices.

1 Why revoke and rotate SSH keys?

Revoking and rotating SSH keys ensures that only authorized users and devices can access your servers. Revoking means removing the public key from the authorized_keys file on the server, which prevents the corresponding private key from logging in. Rotating means generating a new pair of keys and replacing the old ones on both the client and the server. This way avoids using the same keys for too long, which could increase the chances of exposure or compromise. Revoking and rotating SSH keys regularly help maintain a high level of security and compliance.

Add your perspective

Chris M.

🏆Top Voice 🎙️Host 💡Ex-CISO 💬Advisor 💰Investor 💼Entrepreneur 💻Hacker -REal0day
Report contribution
As humans, we generally do not get rid of our devices. This means that they may still have SSH keys on them, so it's always a good thing to revoke and rotate SSH keys. Default is usually 2 years, but set it based on you needs. If you don't know, 2 years is a good starting point.

Like
Dave Wreski
Report contribution
I have learned that periodically revoking and rotating SSH keys is crucial for maintaining a secure network. This practice offers several benefits and protects against potential security breaches. It helps minimize the chances of unauthorized access, limits the impact of key exposure, and promotes compliance with industry standards. It also safeguards against insider threats, helping to mitigate risks associated with personnel changes and role adjustments. Regularly revoking and rotating SSH keys promotes better auditability, allowing for improved tracking and monitoring of key usage. Overall, adopting this practice has been an effective way to maintain the security and integrity of my network.

Like

2 How to revoke SSH keys?

There are different methods and tools to revoke SSH keys, depending on how you manage and distribute them. One of the simplest ways is to manually edit the authorized_keys file on the server and delete the public key that you want to revoke. However, this can be tedious and error-prone, especially if you have many servers and keys. A better option is to use a centralized tool or service that can automate and simplify the process of revoking SSH keys across multiple servers. For example, Ansible, a popular configuration management tool, can create a playbook that can revoke SSH keys based on variables or inventory groups. Alternatively, use a dedicated SSH key management service, such as Keyhub or Userify, that can provide a web interface and an API to revoke SSH keys with a few clicks or commands.

Add your perspective

Dave Wreski
Report contribution
In my experience with open source, revoking SSH keys involves identifying the key, removing it from the authorized keys file, updating relevant services, and notifying impacted users. Maintaining documentation is essential for tracking and audits. It's crucial to keep open-source software updated and follow community best practices to prevent vulnerabilities. Handling SSH key revocation with care prevents unintended access or disruption and helps to maintain network security.

Like

3 How to rotate SSH keys?

To rotate SSH keys, generate a new pair of keys on the client, copy the new public key to the server, and delete the old keys from both sides. Use the ssh-keygen command to generate new keys and the ssh-copy-id command to copy the public key to the server. However, these commands need to be executed for each server and each user, which can be time-consuming and repetitive. A more efficient way is to use a tool or service that can automate and streamline the process of rotating SSH keys. For example, Certbot, a tool that can issue and renew certificates from Let's Encrypt, generates and rotate SSH keys using a cron job or a systemd timer. Alternatively, a service like Keyhub or Userify can handle the key rotation for you and notify you when it is done.

Add your perspective

Dave Wreski
Report contribution
In my experience with open source, rotating SSH keys is critical for bolstering network security. To effectively rotate SSH keys, I follow a few unique ideas. I generate a new SSH key pair using open-source tools like OpenSSH, ensuring a secure and random key generation process. Update the SSH key in the `~/.ssh/authorized_keys` file on the server, replacing the old key with the new one.

Like

4 How often to revoke and rotate SSH keys?

The frequency of revoking and rotating SSH keys is determined by your security policy, compliance requirements, and threat landscape. To ensure maximum security, revoke SSH keys immediately when they are no longer needed, such as when an employee leaves or a device is lost or stolen. Additionally, it’s recommended to rotate SSH keys periodically, like every 30, 60, or 90 days depending on the sensitivity and criticality of your servers and data. Furthermore, rotate SSH keys whenever you change your password or passphrase, as they are linked to your private key encryption. Lastly, it’s important to rotate SSH keys whenever you upgrade your operating system or software as they may introduce new vulnerabilities or compatibility issues.

Add your perspective

5 How to monitor and audit SSH keys?

Revolving and rotating SSH keys is not enough to ensure your SSH security; monitor and audit your SSH keys regularly. This involves keeping an inventory of all your SSH keys, their owners, and their locations. Log all access attempts—successes and failures—and review the logs for any anomalies or signs of compromise. If any key-related incidents or issues arise, report it and work to resolve it. To facilitate this process, there are a variety of tools and services available such as OpenSSH's built-in logging features, Splunk's SSH monitoring app, or Keyhub's SSH key audit service. Managing your SSH keys is critical for ensuring secure remote access to your servers while also protecting your data and meeting standards. Through proper revocation and rotation of SSH keys when needed, combined with the use of the right tools and services to make this process easier and faster, you can stay on top of your SSH security and performance.

Add your perspective

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

Add your perspective

Dave Wreski
Report contribution
Here's a few other tips I've thought of to keep your open source SSH keys secure: 1. Use strong passphrase 2. Regularly rotate keys 3. Restrict key access 4. Keep keys on encrypted storage 5. Keep software up to date Choose a strong passphrase and limit key access only to necessary users. Rotate your keys periodically, ideally with automated scripts. Store keys on encrypted storage and keep software up-to-date to stay protected from vulnerabilities. Following these steps ensures strong security for your SSH keys, preventing any unauthorized access.

Like

How do you revoke and rotate SSH keys when needed?

1

2

3

4

5

6

1 Why revoke and rotate SSH keys?

2 How to revoke SSH keys?

3 How to rotate SSH keys?

4 How often to revoke and rotate SSH keys?

5 How to monitor and audit SSH keys?

6 Here’s what else to consider

Secure Shell (SSH)

Rate this article

Thanks for your feedback

More articles on Secure Shell (SSH)

More relevant reading