SSHKeyMan

Stale SSH keys are one of the quietest breach paths in any infrastructure: a contractor leaves, a key is forgotten, and the access remains. SSHKeyMan closes that gap by deriving your server keys from the identity provider you already trust.

Why teams choose SSHKeyMan

SSH keys are issued like credentials, but they retire like paper: there is no lifecycle, no automatic revocation, and no single place to answer "who can SSH into this box, right now?" Every offboarding is an audit risk, and every forgotten key is standing access for a former employee. SSHKeyMan removes the manual work entirely — keys follow identity, revocation is automatic the moment a user is disabled, and the access trail lives in the directory your team already operates. For compliance reviews, the answer to "who has SSH access" stops being a multi-day exercise and becomes a query.

Capabilities

• Identity-driven provisioning — an NSS module resolves users from Keycloak or LDAP, and a lightweight sync daemon materializes authorized keys on each managed host.
• Instant revocation — the moment a user is disabled, leaves, or rotates keys, SSHKeyMan removes their access on every managed host. No ticket, no cron gap, no forgotten key on a jump box.
• Audit in one place — the access trail lives in the same directory you already operate.

How it works

SSHKeyMan plugs into the identity provider you already run. Its NSS module lets SSH resolve user accounts from Keycloak or LDAP, and a small sync daemon on each managed host keeps authorized_keys in lockstep with the directory: when a user is enabled, their key materializes; when a user is disabled, their key disappears from every host. Provisioning and revocation are the same event viewed from two directions — there is no separate key-management process to drift out of sync.

Deployment and operations

There is nothing new to operate: no separate key server to patch, no new database to back up. The daemon is lightweight, runs alongside your existing hosts, and does one job reliably. Teams that standardize SSHKeyMan typically retire their manual key-issuance runbooks within the first offboarding cycle — from that point on, identity decisions are the only access decisions that matter.