• 490 Posts
  • 4.25K Comments
Joined 2 years ago
cake
Cake day: July 7th, 2023

help-circle



  • This generally referred to as Key Rotation. It applies to everything from SSH keys, to API keys in running apps.

    There are automated ways to do this with ease, but it’s very simple to do with a single script, and some sort of secure key/value store (bitwarden, Vault, etcd…whatever).

    The process is basically something like:

    1. Create a script that runs on cron to check for a key at your k/v store at an expected location, like /ssh_keys/host1-private-12.1.25 and /ssh_keys/host1-public-12.1.25
    2. Deploy this script to all machines you wish to regularly rotate keys on and ensure running properly
    3. Generate new keys and put them in your k/v store at some versioned location/path like /ssh_keys/host1-private-12.21.25 and /ssh_keys/host1-pub-12.21.25
    4. Update your local script that regularly grabs these updated keys to point to the new version uploaded, bonus if your store can symlinkto some other locations like /ssh_keys/host1-private-current
    5. Wait X period of time to ensure all hosts get whatever key they need

    Your script can clear the old keys if needed but simply validating them in the access change serves the same effect. Up to you.