Revoking SSH access to your VPS for a former employee or a lost laptop

A former employee, a web developer whose job is done, or a stolen laptop: anyone who had an SSH key on your server can still log in. A regular key never expires. Whatever you don't remove keeps working, even years later. Here's how to properly revoke access to your VPS.

Step 1: check all keys

Keys are stored per user in ~/.ssh/authorized_keys, one key per line. Check every user, including root:

sudo sh -c 'ls -l /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys'
sudo ssh-keygen -lf /root/.ssh/authorized_keys
sudo ssh-keygen -lf /home/anna/.ssh/authorized_keys

ssh-keygen -lf shows the fingerprint and the comment for each key, such as jan@laptop. That tells you who or which device a key belongs to. That's why it's useful to give every key a clear comment when you create it, and to use a separate key for each device.

1. Make a copy: sudo cp /root/.ssh/authorized_keys /root/authorized_keys.bak.
2. Open the file with sudo nano and remove the line for that person or device.
3. Test in a second window that you can still get in yourself, before closing your current session.

Is there a key you don't recognize and didn't add yourself? That's a red flag: attackers like to plant their own key so they can come back later. In that case, follow Hacked? The first steps.

Step 2: that person's account

If that person had their own user, lock or delete it. First check who is currently logged in with who.

-L locks the password, -e 1 expires the account. Locking only the password doesn't always stop an SSH key; an expired account does. Still remove the keys anyway (step 1). Also check whether there are files for that person in /etc/sudoers.d/, and whether any scheduled tasks run under that name: sudo crontab -l -u jan. On AlmaLinux and Rocky Linux the admin group is called wheel and you delete an account with sudo userdel -r jan.

Step 3: replace passwords and secrets

Removing a key isn't enough if that person has also seen passwords. Replace whatever that person knew or could read:

• The root password. You set it in the VPS screen, Settings tab, or on the server with sudo passwd root.
• Passwords for databases and admin panels, and tokens or API keys in configuration files and .env files. Also replace them at the service that issued them.
• Shared keys for backups, for example the password of your restic repository.

Step 4: your WebOké account

If that person had access to My WebOké, remove that too. With the right permissions, someone can for example manage your VPS there through the VPS screen. Go to My Administration, tab Users, and choose Remove access for that person. See Adding an extra user to WebOké accounts - Managing multiple WebOké accounts with one user. If you've ever shared your own login details, change your password, see Setting, changing or forgetting your password.

A lost or stolen laptop

Remove only the key of that device, on every server where it was installed. Create a new key on your new device and add it, see Putting your key on the server and testing it. If the private key had no passphrase, assume it may have been used and also replace the passwords from step 3. If you can no longer get in yourself, use the console in the VPS screen, see No longer have access to your VPS: what now?

If you reinstall the VPS later, only enter a key in the SSH key field that still belongs to you. Your VPS is fully self-managed: you decide who's allowed on the server. We help with the WebOké part, such as the VPS screen, the console and snapshots.

Want to learn more? Take the free course VPS and Linux server management, lesson 2.1 Creating and using SSH keys or lesson 2.3 Using SSH smartly.