It was a routine audit.
I was going through our authorized_keys files across production servers — something I do every few months, mostly out of paranoia.
Then I saw it.
A key belonging to a developer who had left the company a year and a half ago.
Not a contractor. Not a freelancer.A full-time engineer who had access to everything.Database servers. API endpoints. The works.
He had probably forgotten about it.We had definitely forgotten about it.
This is not a rare story
Ask any sysadmin and they will tell you a version of this. The details change.
The outcome doesn't.
The problem is structural.
SSH was built for individual access.
There is no native concept of a team,a role, or an expiration date.
authorized_keys files multiply silently
across servers. Keys get copied without anyone noticing. Offboarding is manual —and manual means missed.
What went wrong — and why it keeps happening
1. No single source of truth
Every developer manages their own ~/.ssh config.Nobody has a complete picture of who has access to what across the entire infrastructure.
2. Key sprawl is invisible
There is no standard way to audit SSH access.
Keys get copied. Servers get cloned.
The surface area grows quietly.
3. Offboarding is an afterthought
Removing someone from Slack, email, and GitHub takes 10 minutes. SSH? That's on someone's to-do list. It stays there.
4. Rotation is too painful to do
Rotating SSH keys properly means updating every authorized_keys on every server.
In practice, most teams never rotate.
The key that was "temporary" in 2023 is still there in 2026.
What I changed after that day
Centralized every SSH credential in one encrypted place
Assigned access per role — not per individual
Set up an audit trail for every connection
Made offboarding a one-click operation
The tools to do this properly exist now.We just don't talk about them enough.
The question nobody asks until it's too late
How many active SSH keys does your team have right now across all servers?
Not the ones you know about.
All of them.
If you can't answer that question instantly,you have the same problem we had.
Has this ever happened to your team?
How do you handle SSH access management?
Drop your approach in the comments —
I'm genuinely curious how other teams solve this in practice.
Top comments (0)