this post was submitted on 21 Dec 2025
39 points (100.0% liked)

Selfhosted

53808 readers
231 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
39
What is the best trategie to refresh ssh keys? (feddit.org)
submitted 18 hours ago by ratatouille@feddit.org to c/selfhosted@lemmy.world
10 comments fedilink hide all child comments
 

My ssh keys are oldMany times I had the Idea to replace them and cleanup. Put the approach feels old not intuitive and i'm affraid of problems.

How do you manage keys and get sure they do ot get to old.

top 10 comments
sorted by: hot top controversial new old
[–] AbidanYre@lemmy.world 19 points 15 hours ago (2 children)

I moved over to certificates a while ago.

https://smallstep.com/blog/use-ssh-certificates/

[–] bright_side_@piefed.world 3 points 11 hours ago

That's a really interesting read, thanks for sharing

[–] cmnybo@discuss.tchncs.de 2 points 15 hours ago (1 children)

So what happens when the certificate expires? Do you get locked out if you don't have physical access?

[–] non_burglar@lemmy.world 4 points 14 hours ago

Re-gen the keys. In this environment, you would have PKI setup and automation to handle cert renewal.

Having the certs expire is an advantage, security-wise. Auth will expire with certs, stolen creds can be instantly invalidated.

[–] Tabula_stercore@lemmy.world 10 points 9 hours ago

Trategie is vulnerable and deprecated. You might want to try its secure successor Strategie

[–] nesc@lemmy.cafe 5 points 11 hours ago (1 children)

The best way is to use ssh-ca and certificate based auth.

[–] mhzawadi@lemmy.horwood.cloud 3 points 9 hours ago

Ssh-ca is amazing, built my own with small step ca

[–] notabot@piefed.social 4 points 17 hours ago (1 children)

The general process would look something like:

  1. Find all of the SSH keys you want to replace.
  2. For each of thise keys, identify everywhere you use it to authenticate, and write this down! This list will form the basis of the rest of the plan. Make sure you list all of the accounts/servers you log in to, and don't forget things like github or other external systems if you use them.

You'll need to perform the following steps for each SSH key you are replacing:

  1. Rename the public and private keys to something like old_id_rsa and old_id_rsa.pub (obviously use the same type name as your key, just prefix old_)
  2. In your ~/.ssh/config, add a line telling SSH to use the old key as well as the new ones: IdentityFile ~/.ssh/old_id_rsa (change the key filename as aporopriate)
  3. Check you can still log in to the servers you could log in to before. It should still be using the old key, just with a different filename, so it should still work.
  4. Generate your new SSH keys ssh-keygen -t ed25519
  5. Log in to each server and ADD the new ~/.ssh/id_ed25519.pub key to the authorized_keys file or equivalent mechanism. Do not remove the old public key yet.
  6. Remove the IdentityFile line from your ~/.ssh/config
  7. Check you can log in to all your systems. This will validate that your new key is working.
  8. Remove your old public key from the authorized_keys file on each server you log in to.

Depending on your threat model you're going to want to do this more or less often, and so you may want to consider automating it with sonething like ansible if it'll be a regular job.

[–] non_burglar@lemmy.world 3 points 14 hours ago
  1. Find all of the SSH keys you want to replace.

I hate this part.

[–] just_another_person@lemmy.world 1 points 16 hours ago

This generally referred to as Key Rotation. It applies to everything from SSH keys, to API keys in running apps.

There are automated ways to do this with ease, but it's very simple to do with a single script, and some sort of secure key/value store (bitwarden, Vault, etcd...whatever).

The process is basically something like:

  1. Create a script that runs on cron to check for a key at your k/v store at an expected location, like /ssh_keys/host1-private-12.1.25 and /ssh_keys/host1-public-12.1.25
  2. Deploy this script to all machines you wish to regularly rotate keys on and ensure running properly
  3. Generate new keys and put them in your k/v store at some versioned location/path like /ssh_keys/host1-private-12.21.25 and /ssh_keys/host1-pub-12.21.25
  4. Update your local script that regularly grabs these updated keys to point to the new version uploaded, bonus if your store can symlinkto some other locations like /ssh_keys/host1-private-current
  5. Wait X period of time to ensure all hosts get whatever key they need

Your script can clear the old keys if needed but simply validating them in the access change serves the same effect. Up to you.