SSH key response actions require the Responder role. The Respond menu shows on the Details page of an SSH key, and on the pages that show an SSH key for a specific host or user. In the key table of SSH Investigation, the Deduplicate Key and Remove Key buttons in the Actions column run the same actions.

SSH Key Respond Menu Button with Options

Response Actions

The available response actions depend on the state of the SSH key, as described below. Not every key has an action available.

Every requested action and its result will be recorded in the Response Action Log. As an added precaution, a timestamped backup copy of any modified authorized_keys and/or authorized_keys2 files will be created on the target host within the same directory as the modified file.

Key Deduplication

The key deduplication action is available when a user on a host has more than one copy of the same public key, in one file or across the authorized_keys and authorized_keys2 files. Other differences between the matching entries, such as options or comments, do not matter. The same key held by different users or on different hosts is not a duplicate. This action is not available for keys marked as Dead, and it does not affect them.

This action keeps the first matching key entry and removes all later matching lines. This first-match method matches the behavior of OpenSSH. Key entries that are commented out (lines that start with #) are not included in the deduplication, which gives another way to shield entries from this action.

Deduplicate SSH Key Form

Deduplication Scope choices include:

Deduplicate on all hosts - Remove duplicate copies of this SSH key across all hosts, leaving one copy per user.
Deduplicate on a single host - Remove duplicate copies of this SSH key on a single host, leaving one copy per user.
Deduplicate for a single user on a single host - Remove duplicate copies of this SSH key for a single user on a single host, leaving one copy.

Key Removal

The SSH key removal response action allows responders to remove all instances of a specific SSH public key on hosts. This action does not remove keys that are tagged as Protected or marked as Dead (since, by definition, Dead means there are no copies of the key in use). In addition, by default it will not remove a key if doing so would leave a host with no remaining known SSH keys, protecting against accidental lockout.

👍
TIP: Protect all SSH keys that are used by Sandfly
We recommend protecting all SSH keys that are Sandfly Credentials to aid in maintaining operational functionality. Should a key used for Sandfly be removed, the host(s) will produce an authentication error in future connection attempts. Sandfly 5.8 and later will automatically add the public keys for new SSH credentials to SSH Investigation and mark them as protected.

Delete SSH Key Form

Removal Scope choices include:

Remove from all hosts - Delete this SSH key from all hosts for all users.
Remove from a single host - Delete this SSH key for all users on a single host.
Remove for a single user on a single host - Delete this SSH key for a single user on a single host.

Removal Options choices include:

Tag key as banned - The key will be flagged if it reappears on any host.
Allow Last Key Removal - By default, Sandfly prevents deleting the last known key on a host. Enabling this option overrides that safeguard and deletes the key anyway, which may cause loss of access to the affected hosts.

Key Protection

The Remove SSH key action cannot remove SSH keys that have the Protected key tag. The Dedup SSH key action still runs on protected keys and keeps one copy of the key for each user. Protect all SSH keys that are used for Sandfly connectivity.

Within SSH Investigation, there are two basic ways to protect an SSH key:

Add the Protected key tag from any key tags editor.
On the Details page of an SSH key, select Protect SSH key from the Tune menu. In the key table, select the keys, and then select Protect selected keys from the Tune menu in the bulk actions bar.

To end key protection, remove the Protected key tag, or use Unprotect SSH key on the Details page of the key or Unprotect selected keys in the key table.

Auto-Protection

To protect against accidental removal of credentials that Sandfly uses to access hosts, Sandfly will automatically add the public key of each SSH key credential to SSH Investigation and set it as a Protected key. Credentials added to Sandfly prior to version 5.8.0 must be manually protected. To use the Remove SSH key action on these keys, you must first remove the protected status.