Rotating SSH Keys Without a Passphrase

By default, SSH key rotation generates a new passphrase and uses it to encrypt each new private key. For application-to-application SSH, where no user is present to supply a passphrase, you can configure Secret Server to generate an unencrypted private key instead.

An unencrypted private key is protected only by Secret Server encryption at rest and by the file permissions of any system it is deployed to. Anyone who obtains a copy of the key file can authenticate as that account without further credentials. Use this configuration only where a passphrase cannot be supplied, and restrict access to the secret accordingly.
Do not confuse this configuration with the Unix Account (SSH Key Rotation - No Password) secret templates. Those templates omit the account password and authenticate with a key only; the private key they rotate is still passphrase-protected. See Unix Account (SSH Key Rotation - No Password) Secret Template for RPC.

When to Use a Passphrase-Less Key

A passphrase exists so that a human or a credential store can unlock the private key at connection time. In some automated scenarios there is nothing available to hold or enter that passphrase, and a passphrase-protected key would simply block the connection. Typical cases include:

  • Application-to-application or service-to-service SSH authentication, where one application connects to another with no interactive session.

  • Scheduled jobs, build agents, and automation scripts that invoke ssh, scp, or rsync non-interactively.

  • Third-party tooling that consumes an SSH private key file but provides no way to supply a passphrase for it.

If a user, a launcher, or an SSH agent is available to supply the passphrase, leave passphrase generation enabled. Secret Server launchers retrieve the passphrase automatically, so interactive access is not a reason to disable it.

Configuring Passphrase-Less Key Rotation

There are two ways to produce a key without a passphrase, depending on whether you want the behavior to apply to every rotation on a template or only to a single rotation.

Option 1: Omit the PASSPHRASE Extended Mapping

Removing the PASSPHRASE extended mapping from the secret template makes passphrase-less generation the permanent behavior for every secret based on that template. Use this option for templates dedicated to automation accounts.

  1. Search for Secret Templates. The Secrets Administration page is displayed.

  2. In the Core Actions section, click Secret Templates. The list of available templates is displayed.

  3. Select the template used by your automation secrets, then click the Mapping tab.

  4. On the SSH Private Key extended mapping, leave the PASSPHRASE extended field unmapped. Map only PRIVATEKEY and PUBLICKEY.

  5. Click Save.

From this point on, each key rotation on secrets using this template generates an unencrypted private key. For the full extended-mapping reference, see Mapping an SSH Key or Private Key Passphrase for Authentication.

We recommend creating a dedicated template for passphrase-less rotation rather than removing the mapping from a shared built-in template. Removing it from a built-in template changes the behavior for every existing secret that uses it.

Option 2: Leave the Passphrase Blank for a Single Rotation

If the template maps PASSPHRASE and you only need one unencrypted key, leave the passphrase blank during a manual rotation.

  1. On the secret, go to the Remote Password Changing tab and click Change Password Remotely.

  2. Click to select Generate New SSH Key.

  3. Leave the Next Private Key Passphrase text box blank. Do not click Generate next to the field.

  4. Click Change to start the key rotation.

Option 2 applies to that rotation only. Because the template still maps PASSPHRASE, a later scheduled or automatic rotation generates a new passphrase and encrypts the key, which breaks any application relying on an unencrypted key. For secrets that must always have a passphrase-less key, use Option 1.

For the full manual rotation procedure and the requirements for the target machine, see Basic SSH Key Rotation.

Reducing the Risk

Where a passphrase-less key is unavoidable, compensate elsewhere:

  • Restrict the target account to only the commands and paths the application requires, rather than granting general shell access.

  • Restrict secret permissions so that only the automation service and its administrators can view the private key.

  • Rotate on a shorter schedule than you would for a passphrase-protected key, so that a leaked key has a shorter useful life.

  • Where the consuming application writes the key to disk, confirm the key file is owned by the service account and readable only by it.