Stop trusting your internal network just because the firewall is green

Technical Briefing | 9/4/2026

You probably have that one bastion host that everyone uses to jump into the production subnet. It has a static IP, a big stack of allowed keys, and a terrifyingly permissive iptables rule that just opens port 22 to the entire office VPN. The problem is that once someone has a foothold on that box, they own the keys to your kingdom. We call it Zero Trust, but in practice, we usually just build a bigger moat and hope the drawbridge stays up.

Why certificates beat raw public keys

Most of us start by dumping every authorized_key file onto our servers. But that approach dies the moment an engineer leaves the team or loses a laptop. SSH certificates are the real fix here. You sign a user key for an eight-hour window, include the specific host principals, and forget about the long-lived public key headache entirely. It turns your auth system into an ephemeral gatekeeper rather than a static whitelist.

ssh-keygen -s ca_key -I admin_user -V +8h -n app-server-01,prod-cluster user_key.pub

• Certificates expire automatically, so you stop worrying about stale keys.
• You can embed metadata like user identity or job function directly in the cert.
• It removes the need to touch authorized_keys files on every single machine.

Shifting the auth burden to the edge

If you are still managing SSH access by copying around identity files, you are doing it the hard way. Use ProxyCommand or ProxyJump in your ssh config to route everything through a central point, but don’t stop there. Require hardware security keys for that jump host so the remote session actually maps back to a physical person holding a FIDO2 token. If you ever have to explain to an auditor why you don’t have a record of who logged in, that is the day your strategy should have changed.

Go audit your bastion’s authorized_keys file right now. You will likely find a key from 2017 belonging to someone who hasn’t worked at the company in years. Delete it, then move your access control to a short-lived signing authority before you have to clean up a real breach.