How to rotate SSH keys

When

• Key material may be compromised
• Device lost / operator offboarding
• Scheduled hygiene

Steps

1. Generate a new ED25519 key on the client (not on the server):

   ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519_aux_$(date +%Y%m%d) -C 'ty@device-rotated'

2. Install the new public key on aux for ty while you still have working access:

   ssh-copy-id -i ~/.ssh/id_ed25519_aux_YYYYMMDD.pub ty@147.93.186.68

3. Verify a new session using only the new key:

   ssh -i ~/.ssh/id_ed25519_aux_YYYYMMDD -o IdentitiesOnly=yes ty@147.93.186.68 'echo ok'

4. Remove old public keys from ~ty/.ssh/authorized_keys on aux (keep at least one known-good key).
5. Update fleet ~/.ssh/config and the SSH host inventory.
6. Revoke the old private key everywhere it was stored.

Host policy notes

• Root: PermitRootLogin prohibit-password; no root authorized_keys in baseline docs.
• Prefer finishing with PasswordAuthentication no once key mesh is verified (SSH reference).