---
id: MOD-007
type: module
status: active
title: Manage SSH Keys Role
created: 2026-09-09
updated: 2026-09-09
tags: [module, ssh, hardening, ansible]
related: [REQ-006, ALERT-20260909-001]
source_paths:
- roles/manage-ssh-keys/
confidence: confirmed
---

# Manage SSH Keys Role

## Responsibility

Harden SSH access by enforcing an allow list (`good_keys`) and removing
deny-listed keys (`bad_keys`) from the target user's authorized keys.

## Source Paths

- `roles/manage-ssh-keys/tasks/main.yml` → `validate-authorized-keys.yml`,
  `add-goodkeys.yml`, `remove-badkeys.yml`
- Handlers: `roles/manage-ssh-keys/handlers/main.yml`

## Public Interfaces

- Playbook: `playbooks/hardening/manage-ssh-keys.yml`
  (binds the role directly; **no Debian guard, no `become`**)
- Key variables: `ssh_user` (admin), `good_keys` (allow list),
  `bad_keys` (deny list; supports env-provided JSON overrides via commented
  vars in the playbook).
- Conditional execution: `good_keys.defined and good_keys | length > 0`
  (same for `bad_keys`).

## Important Flows

1. Validate/ensure `~/.ssh` of the logged-in user (0700).
2. Add `good_keys` to authorized keys.
3. Remove `bad_keys` from authorized keys.

## Dependencies

- None (ansible.builtin).

## Tests

- None automated.

## Notes For Agents

- The playbook deviates from the documented convention (Debian guard,
  `become: true`); treat as an intentional gap to confirm before adding
  more hardening playbooks.
- Keys in `defaults/main.yml` are public keys (not secrets); the same allow
  list also exists in `roles/bootstrap/defaults/main.yml`.