Configuring SSH Key Rotation for an Account

This guide describes how to configure automatic SSH key rotation for an account in Fudo Enterprise.

Important

The complete workflow is:

1. Create a secret change policy that generates the SSH key.

2. Create an SSH key secret changer.

3. Store the SSH key as an SSH Key secret in the Password Vault.

4. Assign the changer (and, optionally, a verifier) to that secret.

5. Point the account at the Password Vault secret.

Creating a Secret Change Policy

A secret change policy defines how often the key is rotated and which key algorithm is generated. Create it before the changer so that it can be selected in the changer’s Settings section.

1. Select Password Vault > Secret Changers and go to the Secret Change Policies tab.

2. Click Add Secret Change Policy.

3. In the Name field, enter a unique name (e.g., SSH key policy).

4. Enable Secret change and, in the Change frequency field, define how often the key is rotated.

5. In the SSH Key settings section, from the SSH Key algorithm drop-down list, select the algorithm to generate (e.g., Ed25519).

6. Click Save.

Note

The SSH Key settings apply only when the policy is assigned to a changer whose Object target is SSH key.

Creating an SSH Key Secret Changer

1. Select Password Vault > Secret Changers and click Add Secret Changer.

2. In the Name field, enter a unique name (e.g., SSH key rotation).

3. From the Script type drop-down list, select changer.

4. In the Timeout field, define the script’s execution time limit.

5. From the Object target drop-down list, select SSH key.

Note

After you select SSH key, a Settings section appears where you can select a Secret change policy and, optionally, enable Change secret after checkin and Change secret after session.

6. In the Settings section, from the Secret change policy drop-down list, select the policy created above (SSH key policy). Use Static, without restrictions instead when the key should not be regenerated on a schedule.

7. In the Connection Mode section, select the transport layer (typically SSH).

8. In the SCRIPT tab, add the commands that deploy the new key on the target host.

Note

Instead of entering the commands manually, you can load the built-in SSH key changer script from the Import script drop-down list and adjust it as needed.

The example below (for a Linux host) writes the newly generated public key to the user’s authorized_keys file:

	Action	Command
1	EXPECTED	Last login:
2	INPUT	mkdir -p /home/%%secret_login%%/.ssh
3	INPUT	echo %%new_ssh_public_key%% > /home/%%secret_login%%/.ssh/authorized_keys
4	INPUT	chown -R %%secret_login%%:%%secret_login%% /home/%%secret_login%%/.ssh
5	INPUT	chmod 700 /home/%%secret_login%%/.ssh
6	INPUT	chmod 600 /home/%%secret_login%%/.ssh/authorized_keys
7	INPUT	logout
8	EXPECTED	closed

Note

For an SSH key target, the %%secret_login%% variable is the login stored in the rotated secret, and %%new_ssh_public_key%% is the public part of the key that Fudo Enterprise generates according to the assigned policy.

9. In the VARIABLES tab, fill in every required field (marked with a red dot). Initialize the transport variables (transport_bind_ip, transport_host, transport_port, transport_host_public_key) from the target server object — in this example, the linux server. Then set the following:

   • transport_method – change the Predefined value from password to sshkey.

   • transport_login – set Type to secret and Property to login, then select the privileged secret used to connect (e.g., Admin_314) as the Predefined value.

   • transport_secret – set Type to secret and Property to secret value, then select the same privileged secret (e.g., Admin_314) as the Predefined value.

   • secret_login – the login of the regular user, stored in the secret whose key will be changed. Leave it set to ------ so that the changer can operate on any secret it is run against (self).

Important

The transport_method variable defaults to password. For SSH key rotation you must change its Predefined value to sshkey manually; otherwise the changer will not authenticate to the target host with the key.

10. Click Save.

Note

Create a matching SSH key verifier the same way (set Script type to verifier) if you also want Fudo Enterprise to verify the key stored on the target host.

Storing the SSH Key in the Password Vault

The SSH key that will be rotated must be stored as an SSH Key secret in the Password Vault.

1. Select Password Vault > Organization Vault.

2. Click Add secret, select the SSH Key type, and define the secret.

Note

If the secret already exists (for example, it was created together with the account), you can skip this step.

Assigning the Changer to the Secret

1. Select Password Vault > Organization Vault and open the SSH Key secret.

2. Go to the CHANGERS tab.

3. In the Secret changers field, select your SSH key changer from the Add changer drop-down list.

4. Optionally, in the verifier field, select an SSH key verifier from the Add verifier drop-down list.

5. Click Save.

Note

The Add changer and Add verifier drop-down lists show only secret changers whose Object target matches the secret type — for an SSH Key secret, only SSH key changers appear.

Pointing the Account at the Secret

Finally, make the account use the Password Vault secret so that it always presents the current key.

1. Select Session Management > Accounts and open (or create) the account.

2. In the SETTINGS tab, in the Credentials section, set Replace secret with to Password Vault.

3. From the Secret name drop-down list, select the SSH Key secret configured above.

4. Click Save.

Note

Because the key is managed through the Password Vault, the account’s SECRET CHANGERS tab stays inactive — this is expected. Rotation is driven by the changer assigned to the secret, not by the account.

Related Topics:

• Secret Changers

• Custom Secret Changers

• Accessing Secret Editing

• Creating a Regular Account