0

To this time, I could not find this question on somewhere else. If there is one, please let me know.

One of my old employee got used to use a pem file we generated (Idk when) to login in our freebsd server without using credentials. He has left the company and we want to revoke that pem file in order to avoid him to login our server. Is there any way to disable/invalidate/revoke the pem file?

Thanks

Improve this question
2
  • 1
    By PEM, I assume you mean Base-64 encoded file. Is the PEM file a SSH key or a X509 certificate? The former would be used for SSH login, while the latter would be used to login to a website hosted on your server. You need to clarify this in your question.
    – garethTheRed
    Commented Jun 10, 2018 at 9:43
  • 1
    Sorry for the confusion. It was used for ssh login, not for website related work.
    – hatirlatici
    Commented Jun 10, 2018 at 9:55

2 Answers 2

Reset to default
3

You need to remove the user's public key from the user's authorized_keys file on the server. The default location for this is in the .ssh directory within the user's home directory. For example, for user bloggs the file will be /home/bloggs/.ssh/authorized_keys.

The file will contain the public keys that correspond to the private keys that user bloggs can use to login to your server. If bloggs has left the company, then simply delete all entries. Even better, delete his/her account.

If this is a shared account, you'll need to figure out which public keys in that file corresponds to the private keys bloggs still has access to, and remove just those. Remove the wrong ones and you'll lock out legitimate users. Fortunately, many entries in the authorized_keys file have a comment consisting of the user's details at the end of the key. This may help you weed out the keys you need to remove.

Improve this answer
1
  • Thanks for the detailed answer. I'll try and put the results the findings.
    – hatirlatici
    Commented Jun 10, 2018 at 10:57
1

It depends what service he was logging in to. Most applications which make use of SSL have an optional RevokedKeys option which links to a file with a list of revoked keys. These files are generally "crl" files - and googling key revocation (service) should give you precise info.

The name of the option will vary per service - OpenVPN calls the parameter crl-verify, Apache client certs use SSLCARevocationPath, ngix uses ssl_crl

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .