Stop SSH keys from living forever on every developer laptop

Technical Briefing | 8/16/2026

We all have that one server where authorized_keys feels like a graveyard. Keys from ex-employees, keys from long-dead contractors, and keys from that one laptop the intern lost in a cab. It is a security nightmare, but keeping track of them is manual labor nobody enjoys. If you are still relying on static keys distributed via Ansible, you are effectively running a password-less setup that you have simply forgotten to rotate.

Why static keys are a liability

Static keys offer zero visibility into who is actually accessing what. When you audit your system, you see a mess of hashes and zero metadata. You have no way to enforce short-lived sessions without physically editing files on every node. I have seen keys linger in config management repos for years, creating an attack surface that grows linearly with every person you hire.

Moving to ephemeral SSH CA signers

The fix isn’t to audit your files more often; it is to stop trusting files entirely. By setting up an SSH Certificate Authority, you move to short-lived identity. You sign the user key for an hour, or a day, and then it is useless. The server only needs to know the CA public key. Here is how you generate a quick user certificate that expires in four hours, assuming you already have your host CA set up.

ssh-keygen -s /path/to/ca_key -I user_identity -V +4h -n username user_key.pub

• Include identity strings to track individual users in your auth logs
• Enforce strict principals to prevent lateral movement between environments
• Set the validity window to match the user actual shift or window of work
• Avoid adding individual public keys to authorized_keys files on production nodes

If you are worried about the overhead, look at tools like Teleport or Smallstep that automate the signing handshake. They handle the PKI so you don’t have to become an expert in SSH cert internals. But even if you roll your own, the mental shift from permanent access to time-boxed sessions is what actually keeps your infrastructure locked down.