SSH Keys and Distributed Trust

SSH key distribution is the least governed credential system in most organisations, because it never required one to work.

The problem

Keys grant access without any central authority being consulted.

They do not expire. A key added five years ago still works.

They accumulate. Every migration, every engineer, every automation adds more and removes none.

There is no inventory unless someone builds one, host by host.

Private keys sit on laptops, frequently without a passphrase.

A single key may be authorised on hundreds of hosts, and nobody knows which.

Building the inventory

Collect authorised keys from every host, which requires access to every host and is the first difficulty.

Record: host, account, key fingerprint, comment field, and file modification time.

Group by fingerprint to see where each key is trusted.

Match fingerprints to owners, which is where the comment field helps and frequently does not.

Expect a substantial proportion of keys to be unattributable, which is the finding.

What the inventory reveals

Keys belonging to people who left.

Keys with no identifiable owner.

Root-authorised keys, granting direct root access without any elevation step.

Keys authorised across tier boundaries, so a key used for a development host also works on production.

Duplicate keys used by several people, which is a shared credential in another form.

Keys with permissive options, or without the restrictions that could have been applied.

Reducing the exposure

Remove unattributable keys, with a notice period and a route to claim them.

Remove keys belonging to leavers, which requires the inventory to be joined to the directory.

Remove direct root authorisation, requiring login as a named account and elevation.

Apply key options: source restrictions, forced commands, and disabling forwarding and port forwarding where not needed.

Enforce passphrases on private keys, which is a client-side control and needs policy plus tooling.

The better end state

Certificate-based authentication. A short-lived certificate issued by a certificate authority, valid for hours, with the authority trusted by the hosts instead of individual keys.

Removes the distribution problem entirely. No authorised keys file to manage, no rotation, and revocation is a matter of not issuing rather than of visiting every host.

Requires a certificate authority and an issuance path, which is a project, and it is the direction of travel for anyone with more than a small estate.

Brokered access through a bastion that holds the credentials, so engineers never possess a key at all.

Ongoing control

Configuration management owns the authorised keys files, so manual additions are reverted.

Scan periodically for keys added outside the process, which will happen.

Join the inventory to the directory so leavers are detected.

Alert on new root-authorised keys.

Track the count of authorised keys and the proportion attributable, which are the two numbers that show whether the programme is working.

Attributing the unattributable

A large share of authorised keys have no identifiable owner, and there is a method for handling them.

Publish the fingerprints and a claim period.

Notify teams whose hosts carry them.

Match against known keys from laptop inventories and version control, which resolves some.

Check the comment field, which sometimes names a person or a host.

Remove what remains unclaimed after the period, with a rollback.

Expect a small number of breakages and handle them as they surface, which is a better outcome than leaving unattributable access in place indefinitely.

Moving to certificates

The structural fix, and it is a project rather than a configuration change.

A certificate authority issues short-lived certificates to authenticated users.

Hosts trust the authority, not individual keys.

Authorised keys files become empty, which removes the distribution and rotation problem entirely.

Revocation is a matter of not issuing, rather than of visiting every host.

Requires: the authority, an issuance path integrated with your identity provider, host configuration, and a break-glass route for when issuance is unavailable.

Start with new hosts, and migrate the estate as machines are rebuilt for other reasons.