> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/server/knowledge-base/how-to-articles/set-up-centralized-ssh-key-rotation.md).

# Set up centralized SSH key rotation

Rotating SSH key manually across large, complex environments can become unwieldy and raise security risks. We therefore recommend using Devolutions Server’s PAM features to centralize SSH key management.

This method is rather straightforward: SSH keys imported from an [SSH key provider](https://docs.devolutions.net/pam/server/providers/managed-providers/ssh-key-provider/) in Devolutions Server are linked to SSH entries in Remote Desktop Manager, allowing for simplified, centralized key management.

### Secure SSH key rotation with StrictModes

Devolutions PAM’s SSH key rotation requires access to `authorized_keys` files in your managed systems. It is therefore recommended to use the `StrictModes` configuration within your SSH server settings.

For `StrictModes` compatibility, use the following commands on filesystems supporting Access Control Lists (ACLs):

```console
setfacl -m u:<PAM_USER>:--x /home/<ACCOUNT>
setfacl -m u:<PAM_USER>:--x /home/<ACCOUNT>/.ssh
setfacl -m u:<PAM_USER>:rw /home/<ACCOUNT>/.ssh/authorized_keys
```

Replace `<PAM_USER>` with the username of the account Devolutions PAM uses to manage SSH keys and switch `ACCOUNT` with all the accounts to be managed with SSH keys.

#### In Devolutions Server

1. In Devolutions Server, go to ***Administration*** – ***Privileged access*** – ***Providers*** and click the ***Add*** (***+***) icon. Select the ***SSH key*** managed provider type.

   ![](https://cdnweb.devolutions.net/docs/DVLS4198_2025_1.png)
2. Enter the required information. Be sure to check both ***Add PAM vault*** and ***Add a new account discovery configuration.***

   ![](https://cdnweb.devolutions.net/docs/DVLS4199_2025_1.png)
3. Click on ***Test connection*** to make sure everything is in order, and ***Save*** the provider.
4. Then, in the ***Account discovery configuration*** window, enter a name and click ***Ok***.
5. Head over to ***Administration*** – ***Privileged access*** – ***Account discovery configurations***. Click on the ***View result*** button (eye icon) of the newly created account discovery configuration.

   ![](https://cdnweb.devolutions.net/docs/DVLS4200_2025_1.png)
6. Select the SSH key you wish to use and click on the ***Import selected computers*** button.

   ![](https://cdnweb.devolutions.net/docs/DVLS4201_2025_1.png)
7. Set a destination folder for the imported key and click ***Ok***.

#### In Remote Desktop Manager

1. Click ***Add a new entry*** and create an [SSH terminal session entry](https://docs.devolutions.net/rdm/kb/knowledge-base/entry-settings/ssh-session-entry/). Enter host and credentials.
2. In the ***General*** sub-tab of the ***SSH key*** tab, set the ***Entry type*** to ***Privileged account***. Click the ellipsis (***…***) icon right of the ***Account*** field and find your PAM account.

   ![](https://cdnweb.devolutions.net/docs/DVLS4203_2025_1.png)
3. Click ***Ok***, and then ***Add*** to finalize entry creation.

To make sure the method worked, check out the SSH terminal entry in Remote Desktop Manager, and enter `cat ~/.ssh/authorized_keys` in the console. The key returned should then match the one in the PAM folder created during step #7 in Devolutions Server.

#### See also

* [Devolutions Academy – Centralize SSH key rotation with Devolutions PAM](https://academy.devolutions.net/student/activity/3039494-centralize-ssh-key-rotation-with-devolutions-pam)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.devolutions.net/server/knowledge-base/how-to-articles/set-up-centralized-ssh-key-rotation.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.