SSH Key Revocation: What to Change and Verify

When you revoke an SSH key, you must update the server’s ~/.ssh/authorized_keys file and verify that the key is no longer accepted, while also confirming that your other keys and connections still work. This article explains exactly what to change on your server, how to test the revocation, and what to watch out for.

Why Revocation Matters

SSH keys are long-lived credentials. If a key is lost, stolen, or used by someone who left your team, it remains valid until you remove it. Unlike passwords, they don’t expire by default. Revocation is the process of making a specific public key unusable on your server. Without it, a compromised key gives an attacker persistent access, even if you change passwords or rotate other credentials.

What to Change on the Server

The primary change is removing the corresponding public key line from the authorized_keys file of every user account that had it. The file is typically at ~/.ssh/authorized_keys (or /home/username/.ssh/authorized_keys for a specific user). Use a text editor or a command like sed to delete the exact line. For example:

sed -i '/ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI.../d' ~/.ssh/authorized_keys

If you manage keys centrally (via a configuration management tool like Ansible, Puppet, or a cloud metadata service), update the source of truth and push the change to all servers. Also check for other locations where the key might be copied, such as ~/.ssh/authorized_keys2 (older systems) or a user’s ~/.ssh/ directory if they had multiple keys.

How to Verify Revocation

After removing the key, you must confirm it no longer works. The most direct test is to attempt an SSH login using the private key that pairs with the revoked public key. On a client machine, run:

ssh -i /path/to/private_key user@server

If the key is properly revoked, the server will reject it and prompt for a password (if password auth is enabled) or fail with “Permission denied (publickey)”. Also check the server’s auth log (e.g., /var/log/auth.log on Debian/Ubuntu, /var/log/secure on RHEL/CentOS) to see the rejection entry. A successful revocation will show a message like Failed publickey for user or No supported authentication methods.

Additionally, verify that other keys still work. If you have a backup key or a different user’s key, test it to ensure you haven’t accidentally removed the wrong line or broken the file (e.g., by introducing a syntax error).

Common Mistakes and Pitfalls

• Removing the wrong key: Always compare the fingerprint of the key you intend to revoke with the line you delete. Use ssh-keygen -lf /path/to/public_key to get the fingerprint, then search the authorized_keys file for that fingerprint (though the file stores the key, not the fingerprint, so you may need to compute it for each line).
• Leaving backup copies: Keys can be copied to other servers or to a user’s ~/.ssh/ directory. Check all servers that use the same key.
• Breaking the file format: If you edit manually, ensure you don’t leave extra blank lines or split a key across lines. A malformed authorized_keys file can cause all key logins to fail.
• Forgetting about ~/.ssh/authorized_keys2: Older systems may use this file. Check both.
• Not testing after change: Always test with the revoked key and a known-good key.

Revoking Keys in SSH Certificate Systems

If you use SSH certificates (where a CA signs user keys), revocation is different. Instead of editing authorized_keys on each server, you maintain a Key Revocation List (KRL) or a revoked_keys file. The server is configured to check this list during authentication. In OpenSSH, you can use the RevokedKeys directive in sshd_config to point to a file containing public keys that should be rejected. When a key is revoked, you add its public key to that file, and the server will refuse it immediately, without needing to touch every user’s authorized_keys. This is more scalable for large fleets.

When to Revoke vs. Rotate

Revocation is the immediate removal of a key’s access. Rotation is the process of replacing a key with a new one. In practice, you often do both: revoke the old key and add the new one. For example, if an employee leaves, you revoke their key. If you suspect a key is compromised but you still need access, you rotate it—generate a new key pair, add the new public key to the server, and revoke the old one. Rotation is also good practice periodically, even without a security incident, to limit the window of exposure if a key is silently stolen.

Frequently Asked Questions

How do I find which key is which in authorized_keys?

Each line in authorized_keys starts with the key type (e.g., ssh-rsa, ssh-ed25519), followed by the base64-encoded key, and often a comment at the end (like user@host). The comment is for your reference; it may not be unique. To identify a key, compute its fingerprint with ssh-keygen -lf on the public key file, then compare it to each line’s fingerprint by running ssh-keygen -lf on the line (you can pipe the line to ssh-keygen).

Can I revoke a key without removing it from authorized_keys?

Yes, if you use the RevokedKeys option in sshd_config. This is a global list that the server checks before accepting a key. It’s useful when you want to revoke a key across many servers without editing each user’s authorized_keys. However, it only works for keys that are presented by the client; the server will reject them even if they appear in authorized_keys.

What if I accidentally revoke the wrong key?

If you removed a line from authorized_keys, you can re-add it if you have a backup. If you used a RevokedKeys file, simply remove the key from that file and restart sshd. Always keep a backup of your authorized_keys files (e.g., via version control or a cron job) so you can recover from mistakes.

Does revoking a key affect existing SSH sessions?

No. Revocation only affects new authentication attempts. An already established SSH session will continue until it is closed or the connection times out. If you need to immediately terminate a session from a revoked key, you must kill the process or use a tool like pkill to end the session.

How do I revoke a key on a server that uses LDAP or Active Directory?

If your SSH keys are stored in a central directory (like LDAP), you need to remove the key from the directory entry for the user. The process depends on your directory software. After removal, the server will no longer see the key during authentication. You may also need to clear any cached data on the server (e.g., nscd) to ensure the change takes effect immediately.

What is the difference between revoking a key and deleting it from authorized_keys?

Deleting from authorized_keys is the most direct method and works for a single server. Revoking via a RevokedKeys file is a server-wide policy that can be managed centrally. Both achieve the same result: the key is no longer accepted. The choice depends on your infrastructure size and management style.

Related

• Share Copilot Audio Without Source Files
• Redmi 13C 5G vs Redmi 13 5G: Which Specs Matter More?
• CERN Antimatter Scientists Hydrogen Colour