Stop trusting your home network for SSH access

Technical Briefing | 9/27/2026

I see too many teams treating the internal office or home network as a protected zone. You rely on a VPN, think you’re safe, and leave your SSH port exposed to anyone on the local segment. It is a lazy habit that eventually bites back when someone plugs in a compromised device. Zero Trust shouldn’t be a buzzword, it should be how you manage access to your own boxes.

The SSH identity dilemma

Storing long-lived SSH keys on your laptop is a liability. If your machine is compromised, the attacker has the keys to the kingdom. Instead, stop using static keys for every daily operation. Use a short-lived certificate authority approach with OpenSSH certificates. It forces users to re-authenticate against an identity provider, making those stolen local keys useless after a few hours.

ssh-keygen -s /path/to/ca_key -I user_identity -V +5m -n root,sysadmin user_key.pub

• Certificates eliminate the need to distribute and revoke public keys manually
• Setting a TTL keeps the blast radius of a lost laptop to a few hours
• You get a clean audit trail by injecting the user identity into the certificate metadata

But don’t just stop at certificates. Couple this with a ProxyJump configuration to ensure your management traffic hits a hardened bastion host first. By forcing all internal SSH traffic through a single point that logs via session recording, you stop flying blind. If you aren’t logging the actual keystrokes of your sessions in a high-security environment, you are just waiting for a forensic nightmare.

Next time you are setting up a new host, try adding the CA public key to the trusted user CA file. It is a bit more setup work upfront, but it pays for itself the moment you need to rotate access across a hundred servers. Spend an hour on the CA infrastructure today instead of spending a weekend scrubbing for a breach later.