Use this document to enable automatic rotation on an SSH key that uses the Ed25519 algorithm in Segura® SaaS. Once configured, Segura® generates a new Ed25519 key pair on the defined schedule, updates the public key on the target host, stores the new private key, and invalidates the previous key.
Requirements
- An admin-level account on the Segura® SaaS platform.
- A target device already registered in PAM Core, reachable from the platform.
- The target host must run OpenSSH 6.5 or later, which is the minimum version that supports the Ed25519 algorithm.
- A credential or SSH key with permission to write to the target user's
~/.ssh/authorized_keysfile on the host, unless the rotated key authenticates itself. - A password policy assigned to the SSH key, because Set a password when renew the key is required.
Procedure
-
Open the SSH key registration form.
- To configure rotation on an existing key: navigate to PAM Core > Credentials > SSH Keys, locate the key, and select Edit in the Actions column.
- To create a new Ed25519 key and configure rotation in the same flow: navigate to PAM Core > Credentials > SSH Keys > Add.
-
Set the algorithm to Ed25519. On the Information tab, open the SSH Key Algorithm dropdown and select Ed25519.
-
Complete the remaining tabs as needed. Fill in the Key data, Devices, and Session settings tabs. For field-by-field details, see SSH key registration.
-
Open the Key renewal tab.
-
Activate the Enable automatic change toggle. Activating this toggle reveals the remaining rotation fields.
-
Activate the Set a password when renew the key toggle. This field is required when automatic change is enabled.
-
Choose the authentication path for the rotation operation:
- To use the key being created or edited as the authentication key during rotation, activate the Use the key itself to connect toggle.
- Otherwise, leave Use the key itself to connect off and select a credential or key from the Credential or SSH key for authentication dropdown.
-
Click Continue. The form advances to the Review tab.
-
Confirm the settings on the Review tab and submit the form. Click the Save button at the end of the page.
Confirm your results
- The key appears in the SSH Keys list with the SSH Key Algorithm column showing ED25519.
- On the next scheduled rotation, Segura® generates a new Ed25519 key pair, applies the public key to the target host, and stores the new private key. Subsequent SSH sessions through the Web Proxy and Terminal Proxy use the rotated key without further action.
- To verify a rotation operation, open the SSH key detail screen and check the events list. Each rotation event records the key type, result, timestamp, and target host. For details, see SSH keys details.
Troubleshooting
-
Problem: Rotation fails with an error indicating the host does not support Ed25519.
- Solution: Verify the target host runs OpenSSH 6.5 or later. Update the host's OpenSSH package, or change the key's SSH Key Algorithm to RSA or ECDSA (P-256) on the Information tab.
-
Problem: Rotation fails with a permission error on the
authorized_keysfile.- Solution: Verify the credential or key selected in Credential or SSH key for authentication has write permission to the target user's
~/.ssh/authorized_keysfile on the host.
- Solution: Verify the credential or key selected in Credential or SSH key for authentication has write permission to the target user's
-
Problem: Rotation fails due to a network or connectivity error.
- Solution: Verify connectivity from Segura® Platform to the target host. When rotation fails mid-operation, the previous key remains active and continues to authenticate sessions until the next scheduled attempt.