We all love the simplicity of a single SSH jump host. You lock it down with keys, put it behind a firewall, and call it a day. But I have seen enough compromises to know that once a bad actor grabs that bastion, your internal network effectively becomes their playground. Relying on an IP-based perimeter in a world of lateral movement is a dangerous gamble.

Kill the permanent trust relationship

The fix isn’t necessarily replacing your infrastructure, but changing how you authorize sessions. Instead of long-lived keys, you should be issuing short-lived, ephemeral certificates. This shifts the security burden from guarding a static file on your laptop to verifying identity at the moment of connection. If a key leaks, it’s useless by lunch time.

ssh-keygen -s /path/to/ca_key -I key_id -n principal -V +5m /path/to/user_key.pub

• Restrict principal access so keys can only touch specific destination hosts
• Force agent forwarding to be disabled in your global ssh_config
• Integrate your SSH CA with your existing OIDC provider for actual MFA
• Require a hardware token check for every single signing event

Why certificates beat raw keys

You don’t need a massive commercial suite to implement this. A simple internal CA handles the signing, and the SSH daemon handles the validation natively. Once you stop managing thousands of authorized_keys files and start managing a single trust anchor, the operational friction drops significantly. It is a bit more setup work upfront, but it beats auditing thousands of lines of public keys every time someone leaves the team.

If you are still distributing public keys via Ansible, you are already behind the curve. Spend a weekend moving your team to signed certificates and watch your incident response load shrink.