{"id":999,"date":"2026-08-28T23:20:19","date_gmt":"2026-08-28T23:20:19","guid":{"rendered":"https:\/\/virtualserversvps.com\/blog\/?p=999"},"modified":"2026-10-01T22:02:49","modified_gmt":"2026-10-01T22:02:49","slug":"ssh-security-best-practices-vps-2","status":"publish","type":"post","link":"https:\/\/virtualserversvps.com\/blog\/ssh-security-best-practices-vps-2\/","title":{"rendered":"SSH Key Rotation Across a VPS Fleet: Inventory, Overlap, and Stale-Key Detection"},"content":{"rendered":"
\n\n

Key rotation is easy on one server and painful on fifty. The failure modes are predictable: a key removed from two hosts but not the third, an automation account nobody remembers owning, and an authorized_keys<\/code> file that grew organically for three years. This guide describes a repeatable process for auditing and rotating SSH keys across a VPS fleet without locking yourself out.<\/p>\n\n\n\n

Build an inventory before you touch anything<\/h2>\n\n\n\n

You cannot rotate what you have not enumerated. Collect every authorized_keys<\/code> file across the fleet, along with the comment field and fingerprint of each entry. A short loop over your host list produces a machine-readable snapshot you can diff later.<\/p>\n\n\n\n

for host in $(cat hosts.txt); do\n  ssh \"$host\" 'cat \/root\/.ssh\/authorized_keys \\\n    \/home\/*\/.ssh\/authorized_keys 2>\/dev\/null' \\\n    | sed \"s|^|$host |\"\ndone > keys-inventory.txt<\/code><\/pre>\n\n\n\n
Then normalize: extract the key type, base64 blob, and comment for every line, and compute the SHA256 fingerprint with ssh-keygen -lf<\/code>. Grouping by fingerprint immediately reveals which keys appear on the most hosts and which comments are missing. Keys with no comment are the ones that cause incidents.<\/p>\n\n\n\n
Classify keys by purpose<\/h2>\n\n\n\n
Class<\/th>Examples<\/th>Rotation cadence<\/th><\/tr><\/thead>
Human operator<\/td>Named engineer laptop keys<\/td>90 days or on offboarding<\/td><\/tr>
Automation<\/td>CI runners, deploy bots<\/td>180 days, scoped per host<\/td><\/tr>
Shared\/service<\/td>Legacy shared logins<\/td>Eliminate; replace with roles<\/td><\/tr>
Break-glass<\/td>Emergency console key<\/td>Annual, stored offline<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Shared accounts are the highest-risk category. They make attribution impossible and force you to rotate everywhere at once when any one holder leaves. Replace them with role-based certificates where possible. If you are still weighing how much operational overhead to carry in-house versus paying a provider, our managed vs unmanaged breakdown<\/a> is a useful input.<\/p>\n\n\n\n
Rotate without an outage<\/h2>\n\n\n\n
  1. Generate the new keypair on the owner’s machine. Never generate private keys on a shared server.<\/li>
  2. Add the new public key to every host where the old one exists. Overlap matters: both keys work during the window.<\/li>
  3. Verify login with the new key on each host, including any hosts behind a bastion.<\/li>
  4. Remove the old public key only after verification passes everywhere.<\/li>
  5. Re-run the inventory and confirm the old fingerprint count is zero.<\/li><\/ol>\n\n\n\n
    The overlap window is the critical control. Removing first and adding later is how teams lock themselves out of production at 02:00. Always add, verify, then remove.<\/p>\n\n\n\n
    Detect stale and orphaned keys<\/h2>\n\n\n\n
    A key is stale when no session has used it in a defined period. Match your inventory against authentication logs to find candidates. The sshd<\/code> logs record the key fingerprint for each accepted login when LogLevel VERBOSE<\/code> is set, giving you a usage timestamp per key.<\/p>\n\n\n\n
    journalctl -u ssh --since \"90 days ago\" \\\n  | grep -i \"Accepted publickey\" \\\n  | grep -oE \"SHA256:[A-Za-z0-9+\/]+\" \\\n  | sort | uniq -c | sort -n<\/code><\/pre>\n\n\n\n
    Keys that never appear in this list but exist in the inventory are unused. Review them with the owner, then remove. Orphaned automation keys with no matching CI job should go immediately.<\/p>\n\n\n\n
    Automate enforcement<\/h2>\n\n\n\n