# Managing SSH Keys and Key Groups

PAM360 offers comprehensive SSH key management for securely handling key associations, rotations, and deployments across various user accounts and resources. Key features include associating SSH keys with individual accounts or resources, automating key rotation on a schedule, dissociating keys to revoke access, and pushing key files to remote users. PAM360 also provides bulk key management with key groups, allows customization of user home directories for key deployment, and supports key file export and audit history tracking for thorough oversight and compliance.

This document traverse you through the SSH keys management operations performed from the PAM360 interface.

1. [Associating SSH Keys with User Accounts](https://www.manageengine.com/privileged-access-management/help/ssh_key_management.html#Associating_SSH_Keys)
2. [SSH Key Management Operations](https://www.manageengine.com/privileged-access-management/help/ssh_key_management.html#SSH_Key_Management_Operations)
3. [SSH Key Groups for Management](https://www.manageengine.com/privileged-access-management/help/ssh_key_management.html#SSH_Key_Groups_for_Management)
4. [Miscellaneous Operations](https://www.manageengine.com/privileged-access-management/help/ssh_key_management.html#Miscellaneous_Operations)

## 1. Associating SSH Keys with SSH User Accounts

Upon creating or importing the SSH keys, you can associate them with SSH user accounts either from the **Resources** or **SSH Keys** tab.

> **Caution**
>
> If a root user or administrator credential has been provided for a resource, keys can be associated with all enumerated user accounts of the resource. If there are no keys available in the PAM360 database, then you will be prompted to create a key during association. Create a key pair and return to these steps.

To associate an SSH key with one or more user accounts in an SSH resource, follow these steps:

1. Navigate to **Resources >> All My Passwords >> Passwords** and select the user accounts with which the SSH key to be associated.
2. Click **Associate Keys** from the **Key Actions** dropdown in the top pane.
3. In the **Associate Keys** window, select the required key from the **Select Key** dropdown.
4. Enable the following options as required:
   - **Use private key instead of password for login** - Enable this option to use the selected private key for authentication to the SSH user account instead of a password.
   - **Map private key in PAM360 if key association fails** - Enable this option to map the selected private key to the selected user accounts in PAM360 if SSH key association fails during remote login.
5. Click **Associate**.

![resource-1](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help/resource-1.webp)

To associate an SSH key with one or more user accounts across resources, follow these steps:

1. Navigate to **SSH Keys >> SSH Keys**, select an SSH key from the list, and click the **Associate** button.
2. In the **Public Key Association** window, select the user accounts with which the selected keys are to be associated.
3. If required, select the **Elevate to root user** checkbox.

   > **Additional Detail**
   >
   > For security reasons, root user login might be disabled for servers/machines. Enabling this option elevates a user login from a non-root user to a root user and allows you to associate keys with all other users on the server. Users have to provide root user and any non-root user credentials to PAM360 to elevate to a root user. Refer to [this](https://www.manageengine.com/privileged-access-management/help/remote_password_reset.html#Linux_-_Mac_-_Solaris_-_HP_UNIX_-_IBM_AIX) document to learn about configuring the root and non-root user credentials.

4. Click the **Associate** button.

![resource-2](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help/resource-2.webp)

## 2. Dissociating SSH Keys from SSH User Accounts

To dissociate SSH keys from one or more user accounts in an SSH resource, follow these steps:

1. Navigate to **Resources >> All My Passwords >> Passwords**.
2. Select the user accounts from which you wish to dissociate keys and click **Dissociate Keys** from the **Key Actions** column.
3. In the **Dissociate Keys** window, select the keys to be dissociated from the **List of keys** and click **Select**. To dissociate all available keys at once, click **Select All**.
4. Choose the appropriate dissociation type that follow:
   - **Dissociate from account in PAM360 and remote server** - Enable this option to remove the selected keys from PAM360 and the remote server. Use this option when the keys are no longer required.
     - **Dissociate the key in PAM360 if remote key dissociation fails** - If the remote server is unreachable or credentials are not configured, enabling this option ensures that the key is removed from PAM360 records even if the remote dissociation fails.
   - **Dissociate from account in PAM360** - Removes the selected key from PAM360 records only. The key remains active on the remote server and users can still authenticate with it directly, outside of PAM360. PAM360 will no longer manage or rotate the key after this operation.
5. Click **Dissociate**.

![resource-3](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help/resource-3.webp)

To dissociate SSH key from one or more user accounts across resources, follow these steps:

1. Navigate to **SSH Keys >> SSH Keys** and select a single key that has to be dissociated.
2. Click **Dissociate** from the **More** drop-down list.
3. Select the user accounts across resources from which the key is to be dissociated.
4. If required, select **Dissociate key in PAM360 if key dissociation fails**. Enable this option to dissociate the key from the selected user accounts in PAM360 if SSH key dissociation fails during remote login.

![resource-4](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help/resource-4.webp)

> **Additional Detail**
>
> PAM360 does not allow deletion of a user account that has SSH keys associated with it. Dissociate all the associated keys before attempting to delete the user account.

## 3. SSH Key Management Operations

### 3.1 Rotate SSH Keys

You can configure PAM360 to rotate the SSH keys at periodic intervals automatically. With a single click, all the deployed keys can be replaced. The keys can be rotated based on a schedule or anytime based on your need.

To schedule the rotation of keys, follow the below steps:

1. Navigate to **SSH Keys >> SSH Keys** and select the keys to be rotated.
2. Click the **Rotate** option. In the pop-up that opens, enable the [requirements](https://www.manageengine.com/privileged-access-management/help/ssh_key_management.html#Push_SSH_Keys_to_Remote_User_Accounts) that follow and click **Rotate**:
   1. Push private key file to remote user account
   2. Push public key file to remote user account
   3. Use keyname as filename

A confirmation message will be displayed, and you will be redirected to the **Key Rotation Audit** page, where the status of rotation is updated.

> **Caution**
>
> Only the keys which have already been associated with user accounts of resources can be rotated.

To schedule the rotation of keys, follow the below steps:

1. Navigate to **Admin >> PKI Management >> Schedules** and click the **Add Schedule** button.
2. In the **Add Schedule** window, enter a name for the schedule and select the type of schedule as **Key Rotation** from the drop-down list.
3. Select the keys to be rotated and enable the requirements that follow:
   1. Push private key file to remote user account
   2. Push public key file to remote user account
4. Select the **Recurrence Type**, **Start Time**, and **Start Date** for rotation. Enter the email addresses of the users with the **Subject**, **Content**, and **Signature** to be notified.
5. Click **Save**.

The result of the scheduled execution will get updated in the **Key Audit**, and the results of the rotation of the keys will get updated in the **Key Rotation Audit**.

### 3.2 Push SSH Keys to Remote User Accounts

In addition to deployment, PAM360 allows you to push a private key or a public key, or both onto its associated user accounts.

#### i. To push a key file to remote user accounts

1. Navigate to **SSH Keys >> SSH Keys** and click on the **Push Key to User** icon beside the selected key.
2. Select the keys that needs to be pushed (private, public, or both), provide the appropriate key names, select the required associated users, and click **Push**. The key files are now pushed to the selected users.

![resource_6](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help/resource_6.webp)

This feature is also available as a part of the **Key Rotation** schedule. After the scheduled key rotation is performed and fresh key pairs are created and deployed, you can automatically push either the private key or both the private and public keys onto its selected associated users by enabling the 'push key to user' option instead of pushing the key files manually after every scheduled rotation.

#### ii. Add commands and restrict host per key

You can add commands to specific user accounts, thereby providing an additional layer of restriction enabling them only to execute the commands on establishing a connection with the host. Also, you can predefine the appropriate key-to-user relationship by specifying the IP address of the user in the appropriate format (as specified below).

To add a command to a public key:

1. Navigate to **Resources >> All My Passwords >> Passwords**.
2. Select the user account for which you want to add a command and click on **Add Command** from the **Key Actions** column.
3. An **Add Command** dialog box opens up, where you can add commands to be executed in the following format: **i.e.,(command="usr/local/bin/script.sh")**.

To restrict hosts for a key, click on **Add Command** and provide the name or IP address of the hosts in the following format: **i.e.,(from="host1/ip1,host2/ip2")**

### 3.3 Edit Authorized Keys File

You can fetch authorized key files from various user accounts, edit the key content and push them to respective user accounts from PAM360. To do this:

1. Navigate to **Resources >> All My Passwords >> Passwords**.
2. Select the required user account and click on **Edit Authorized Keys** from the **Key Actions** column.
3. A window opens displaying the list of public keys in the authorized keys file of the respective user. The keys that are managed using PAM360 are highlighted.
4. You can now edit the contents of the keys displayed and deploy them back to the respective user accounts by clicking the **Push** button.

![resource_7](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help/resource_7.webp)

### 3.4 Delete SSH Keys

When you try to delete the SSH keys from the PAM360 repository, they are first dissociated automatically from their user accounts. Key deletion fails for the SSH keys that are not dissociated from all their user accounts. To delete the SSH Keys:

1. Navigate to the **SSH Keys >> SSH Keys** tab and select the keys to be deleted.
2. Click the **Delete** button from the **More** drop-down list and click **OK** in the confirmation window.

## 4. SSH Key Groups for Management

PAM360 gives the provision to create key groups for easy organization and to carry out operations in bulk. You can assign, delete, or modify the group similar to working with a single SSH key. The list of items available in a group is enumerated in their respective tabs. You can drill down to the individual items by clicking the name of a group.

### 4.1 Create Key Groups

To create a group of SSH keys, follow these steps:

1. Navigate to **SSH keys >> Keys Group** and click the **Add** **Group** button. You will be redirected to the **Add Key Group** window.
2. Enter the name of the group. Take care while choosing the name since it cannot be edited later.
3. You can choose the resources to be added to a group in 2 ways:
   - **By Specific key —** Select the keys to be added to the group individually.
   - **By Criteria —** This serves as a dynamic key grouping. You will specify the exact criteria based on which you want to create the group. Here, you have many options to choose from - you can search for specific keys based on their name, type, length, or creator and filter the search in a fine-grained manner based on the criteria such as "contains", "does not contain", "equals" "not equal", "starts with" and "ends with". Click the Matching Keys button at the bottom-right corner of the window to see the corresponding keys.

     > **Additional Details**
     >
     > If you select the **By Criteria** option, the conditions specified are applicable to keys that are discovered later too. If any of those keys match the criteria, they will be automatically included in the new group.

4. Click **Save** to create the key group.

In addition, you can directly select individual keys from the **SSH Keys >> SSH Keys** tab and click the **Save** button for faster group creation.

![resource_8](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help/resource_8.webp)

### 4.2 Edit Key Groups

To make changes to an existing key group, follow these steps:

1. Navigate to **SSH Keys >> Keys Group** and click the **Edit** icon present in the right corner of the table view.
2. You can change the key selection type and edit the keys available in a group or add, modify, or delete the filters applied to a group.

Once you make changes to the group and save, a message will be displayed confirming the update of the changes.

> **Caution**
>
> The name of the group cannot be modified. However, you can add or modify the description and the list of keys available in it.

### 4.3 Rotate Keys in a Key Group

To rotate all the keys of a key group, navigate to **SSH Keys >> Keys Group**, select the key groups and click the **Rotate** button. You will be now redirected to the **Key Rotation Audit** window, where the status of key rotation is updated.

### 4.4 Delete Key Groups

To delete a key group, navigate to **SSH Keys >> Keys Group**, select the key groups and click the **Delete** button. A pop-up window will appear to make sure that the selected groups are to be deleted. Click **OK** to delete the groups.

## 5. Miscellaneous Operations

### 5.1 Customize User Home Directory

You can customize the home directories of the users, i.e., the location where the public key is to be deployed. To do this:

1. Navigate to **Resources >> All My Passwords >> Passwords**.
2. Click the **Edit User Path** from the **Key Actions** column dropdown.
3. Enter the modified path and click **Save**.

### 5.2 Export SSH Keys

To export key files by selecting them from the resources with which they are associated:

1. Navigate to the **Resources >> All My Passwords >> Passwords** tab in the GUI.
2. Click the name of the resource in which the key is deployed and click the **Export** button.

To export the key files, navigate to the **SSH Keys >> SSH Keys** tab and click the **Export Keys** icon available in the right corner of the table view corresponding to the required key.

> **Additional Details**
>
> Even while exporting, the passphrases used to protect the keys are still in effect. That is, if the keys are to be used elsewhere, the passphrases have to be provided.

### 5.3 View SSH Key History

Using PAM360, you can view the history of each SSH key, from the moment it was created or imported, and the subsequent rotations along with time stamps. To view the history of any key, navigate to the **SSH Keys >> SSH Keys** tab, select a single key and click the **Key History** button.

### 5.4 Export Discovered Keys Report

A report of the discovered keys can be exported as PDF or to an email id. To export the report:

1. Navigate to **SSH Keys >> Discovered Keys** and select a single key.
2. Click the **Export** button. You can export the report to the system as a PDF file or to desired email addresses.
   - **PDF:** Export and save the report of the discovered keys as a PDF in the system.
   - **Email:** Specify the email addresses to which the report of the discovered SSH keys is to be exported.