Rotate SSH Authorized Keys Safely

Roll SSH authorized keys with an overlap window so each operator can verify their new key before the old one is removed.

~30 minsshsecurityoperations

Task

Add new public keys, verify access, then remove superseded keys without locking anyone out.

When to use this

A key rotation removes old keys in one change, and someone who missed the notice loses SSH access.

Prerequisites

Ansible or config management for authorized_keys
The new public keys
Out-of-band access as a fallback

Steps

1. Add the new key alongside the old and verify login.

ssh user@host 'echo new key login ok'
ssh-add -l

Expected output: The operator can authenticate with the new key while the old one still works.

2. Remove the old key after the overlap window.

grep -v 'ssh-rsa AAAAB3Nza...old' ~/.ssh/authorized_keys > /tmp/ak && mv /tmp/ak ~/.ssh/authorized_keys
ssh -o IdentitiesOnly=yes -i ~/.ssh/new_key user@host true

Expected output: The old key no longer authenticates and the new key still works.

Troubleshooting

Problem

Someone still depends on the old key

Solution

Announce a removal date and confirm each operator has tested the new key.

Problem

Root lockout

Solution

Keep an out-of-band console path during rotations.

Limitations

Depends on accurate inventory of key owners.
Does not cover hardware token keys.
Requires a fallback access path.

What this recipe does

Add new public keys, verify access, then remove superseded keys without locking anyone out.

A key rotation removes old keys in one change, and someone who missed the notice loses SSH access.

Prerequisites

Ansible or config management for authorized_keys
The new public keys
Out-of-band access as a fallback

Procedure

Add the new key alongside the old and verify login.

ssh user@host 'echo new key login ok'
ssh-add -l

Expected result: The operator can authenticate with the new key while the old one still works.

Remove the old key after the overlap window.

grep -v 'ssh-rsa AAAAB3Nza...old' ~/.ssh/authorized_keys > /tmp/ak && mv /tmp/ak ~/.ssh/authorized_keys
ssh -o IdentitiesOnly=yes -i ~/.ssh/new_key user@host true

Expected result: The old key no longer authenticates and the new key still works.

How to confirm it worked

Run the commands above and confirm every expected result in order. If a step does not produce the stated output, use the troubleshooting notes before continuing. A passing run shows every operator authenticates with the new key and no authorized_keys entry references the retired key.

Troubleshooting

Someone still depends on the old key — Announce a removal date and confirm each operator has tested the new key.

Root lockout — Keep an out-of-band console path during rotations.

Limitations

Depends on accurate inventory of key owners.
Does not cover hardware token keys.
Requires a fallback access path.