SSH keys are one of the most secure ways to authenticate with your server. However, improper key management can introduce vulnerabilities. This guide covers advanced best practices for generating, storing, rotating, and managing SSH keys to keep your Data Mammoth servers secure.

Use Strong Key Types

Always use modern, strong key algorithms:

ssh-keygen -t ed25519 -C "[email protected]"

Protect Your Private Key

Use a Passphrase

Always set a strong passphrase when generating your key. The passphrase encrypts the private key file, so even if someone copies the file, they cannot use it without the passphrase.

ssh-keygen -t ed25519 -C "[email protected]"
Enter a strong passphrase when prompted

Secure File Permissions

Private keys must have strict file permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub
chmod 600 ~/.ssh/authorized_keys

If permissions are too open, SSH will refuse to use the key.

Never Share Your Private Key

• The private key (id_ed25519) stays on your local machine.
• Only the public key (id_ed25519.pub) is placed on servers.
• Never email, message, or upload your private key.
• Never commit private keys to version control.

Use an SSH Agent

The SSH agent holds your unlocked private keys in memory, so you only need to enter your passphrase once per session:

# Start the SSH agent
eval "$(ssh-agent -s)"
Add your key
ssh-add ~/.ssh/id_ed25519

On macOS, you can add the key to the system keychain:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

One Key Per Purpose

Use separate SSH keys for different purposes:

# ~/.ssh/config
Host work-server
    HostName 203.0.113.10
    User deploy
    IdentityFile ~/.ssh/id_ed25519_work
Host personal-server
    HostName 203.0.113.20
    User root
    IdentityFile ~/.ssh/id_ed25519_personal

Harden SSH Server Configuration

On your Data Mammoth server, configure SSH for maximum security:

sudo nano /etc/ssh/sshd_config

Apply these settings:

# Disable password authentication
PasswordAuthentication no
ChallengeResponseAuthentication no
Disable root login
PermitRootLogin no
Use only SSH protocol 2
Protocol 2
Limit authentication attempts
MaxAuthTries 3
LoginGraceTime 30
Disable empty passwords
PermitEmptyPasswords no
Specify allowed users (optional)
AllowUsers deploy
Disable X11 forwarding (if not needed)
X11Forwarding no
Use only strong ciphers
Ciphers [email protected],[email protected]
MACs [email protected],[email protected]
KexAlgorithms curve25519-sha256,[email protected]

Restart SSH:

sudo systemctl restart sshd

Warning: Test your configuration in a separate terminal before closing your current session. If misconfigured, use the web console to recover.

Key Rotation

Regularly rotate SSH keys to limit exposure from potential compromises:

Rotation Process

Recommended Rotation Schedule

• Individual keys — Every 6 to 12 months.
• CI/CD keys — Every 3 to 6 months.
• After personnel changes — Immediately when a team member leaves.
• After suspected compromise — Immediately.

Audit Your Keys

Regularly review who has access to your servers:

# View all authorized keys
cat ~/.ssh/authorized_keys

Remove any keys you do not recognize or that belong to people who no longer need access.

For managing SSH keys through the Data Mammoth dashboard, see Managing SSH Keys.

What to Do Next

• Managing SSH Keys — Add and remove keys via dashboard.
• Server Firewall Hardening Guide — Complement SSH security with firewall rules.
• Complete Server Security Checklist — Full security review.
• Enable 2FA — Protect Your Account — Secure your dashboard access.