When managing SSH access across multiple clients and servers, the key distribution strategy directly impacts both security and maintainability. Let's analyze each approach with concrete examples:

# Generating the master key
ssh-keygen -t ed25519 -f ~/.ssh/master_key -C "global-access-key"

# Deployment to all clients (manual process)
scp ~/.ssh/master_key user@client-machine:~/.ssh/

Pros: Simple to manage initially with only one keypair to maintain
Cons: Complete compromise if any client is breached. No granular revocation capability.

# On each server:
ssh-keygen -t rsa -b 4096 -f /etc/ssh/server-specific/key_$(hostname)
# Distribute private keys to authorized clients

Use Case: When servers have different security requirements
Warning: Private key distribution becomes complex as infrastructure grows

# Best practice implementation:
for client in laptop desktop workstation; do
  ssh-keygen -t ed25519 -f ~/.ssh/${client}_key -C "${client}-$(date +%Y%m%d)"
  ssh-copy-id -i ~/.ssh/${client}_key.pub user@target-server
done

Advantages:
- Per-client revocation capability
- Audit trails showing which client connected
- Scalable for teams (combine with SSH certificates)

While theoretically most secure, this creates exponential management overhead:

# Sample management script:
CLIENTS=(laptop desktop)
SERVERS=(web01 db01 cache01)

for client in ${CLIENTS[@]}; do
  for server in ${SERVERS[@]}; do
    KEYFILE="~/.ssh/${client}_to_${server}"
    ssh-keygen -t ecdsa -b 521 -f $KEYFILE
    ssh-copy-id -i $KEYFILE.pub $server
  done
done

For larger deployments, consider using OpenSSH certificate authorities:

# CA Setup:
ssh-keygen -t ed25519 -f ca_key
echo "TrustedUserCAKeys /etc/ssh/ca_key.pub" >> /etc/ssh/sshd_config

# Client Certificate Issuance:
ssh-keygen -s ca_key -I "laptop-user" -n "server1,server2" -V +52w laptop_key.pub

• Use ed25519 or RSA 4096-bit keys for new deployments
• Implement key rotation policies (automate with tools like Ansible)
• Store private keys in encrypted form (ssh-agent with PKCS#11 for hardware tokens)
• Use SSH config for alias management:

  Host prod-web
    HostName 192.168.1.10
    IdentityFile ~/.ssh/client_specific_key
    IdentitiesOnly yes

Regularly audit authorized_keys files with tools like:

# Find all authorized_keys files
find / -name authorized_keys -type f -exec ls -la {} \;

# Check last access times
grep "Accepted publickey" /var/log/auth.log | awk '{print $1,$2,$3,$11}'

When working with multiple client machines (laptops, desktops) and server infrastructure, SSH key management becomes crucial for both security and operational efficiency. Let's examine the common approaches and their implications.

Single Global Keypair:

# Generating a single RSA keypair
ssh-keygen -t rsa -b 4096 -C "global_key" -f ~/.ssh/global_key

Pros: Simple to manage. Cons: Compromise of one client exposes all servers.

Per-Server Keypairs:

# Generating server-specific keys
for server in server1 server2 server3; do
  ssh-keygen -t ed25519 -f ~/.ssh/${server}_key
done

Pros: Limits blast radius. Cons: Key management overhead increases with server count.

The most balanced solution is using unique keys per client machine:

# On each client machine:
ssh-keygen -t ed25519 -C "client_$(hostname)_$(date +%Y%m%d)"

Then distribute public keys to servers:

# On servers, maintain authorized_keys with:
# client1.pub
# client2.pub
# client3.pub

Enhance management with ~/.ssh/config:

Host server1
  HostName server1.example.com
  User admin
  IdentityFile ~/.ssh/client1_key
  IdentitiesOnly yes

Host server2
  HostName server2.example.com
  User deploy
  IdentityFile ~/.ssh/client2_key
  IdentitiesOnly yes

• Always use passphrase protection: ssh-keygen -o -a 100
• Rotate keys periodically (every 6-12 months)
• Use modern algorithms: ED25519 preferred over RSA

For convenience without sacrificing security:

# Add keys to agent with timeout
ssh-add -t 8h ~/.ssh/client_key

For larger teams consider:

• HashiCorp Vault for SSH CA
• Teleport for SSH certificate-based auth
• Smallstep for automated certificate rotation