What are the best managers for SSH keys?

Question

SSHInternet SecurityUtility

What are the best managers for SSH keys?

7

Options
Considered

173

User
Recs.

Dec 1, 2023

Last
Updated

5 Options Considered

Best managers for SSH keys	Price	Price	Platforms
83 Userify	PAID	Free up to 20 servers (non-expiring)	-
-- ManageEngine Key Manager Plus	Free / paid	-	Windows, Linux
-- SSH Universal Key Manager	Paid	-	-
-- keyper	Free	-	-
-- SSH KeyBox	Free / paid	-	-

See Full List

Keystash

See flagged products

Built By the Slant team

Find the best product instantly.

4.7 star rating

Try it now - it's free

score 55 · Answer 1

Userify

Top Pro

Installs instantly

The shim (their agent) installs in the blink of an eye. The old server took a lot longer (about five minutes) but only needs one command to install, so you can walk away and come back. (The new server installs in about five seconds as well.) See More

Top Con

Only up to 20 servers are free (10 on self-hosted)

Only up to 20 servers are free. See More

NobleBonaDea's Experience

I enjoy using Userify because it's very fast and easy to use (once you get past the initial company creation and projects). The design seems to be very logical because all of your servers are grouped by function (for example, in your Storefront server group, you might have Wordpress/WooCommerce and Database server instances). It also works great at Digital Ocean and Vultr (quick tip paste the "bash" or "instant deployment" scripts right into their "UserData" textbox). They also have new one-click installers in AWS Marketplace but we mostly use Vultr and DO for our infrastructure. See More

Specs

Price:Free up to 20 servers (non-expiring)

Top Pro

Built-in recipes for Ansible, Chef, Puppet, Terraform, Bash, and CloudFormation

Lots of built-in recipes make deploying pretty fast, and just adding a single server is pasting a one-liner that takes a few milliseconds to install. See More

Top Con

The Userify shim doesn't yet support certain containers

Containers that don't run an SSH server don't support the Userify shim (of course, container hosts are fully supported). See More

MethodicalTheandrios's Experience

Userify is probably the best solution out there. It's the only thing that actually terminates user sessions when you remove the user. I can't find anything that does anything even close to the same. See More

Top Pro

Manages sudo permissions (root/user/none)

It manages sudo permissions (root/user/none) in a nice color-coded interface based on projects. You can manage more than one server in groups. See More

Top Con

Pricey for small companies

A smaller company may find it expensive if you have a lot of servers. See More

PoliteAdgilisDeda's Experience

This is an awesome solution for SSH keys for an entire team. It's not as flashy as some of the competition, but it works really really well and seems very secure, and the architecture and the on-disk agent is simple and bulletproof. See More

Top Pro

When you remove a user, their keys are removed and sessions are KILLED

This is a pretty awesome feature. When you remove a user, not only are their keys removed, but any active sessions are terminated and home directory renamed to deleted:$username so that you can go check it out and get any work files left in it (or hacking evidence). Even better, if you later restore their access, their home directory automatically gets restored as well. See More

Top Con

User interface is slow and clunky

It's not user friendly and some people may struggle to get going with setting up their profiles. See More

Live Wire's Experience

Clunky and hard to use interface but works extremely well. See More

Top Pro

Very reliable across multi-cloud and intermittent connections

A single self-hosted installation or Userify Cloud can manage your user accounts in multiple clouds or your own datacenter. All that's needed is HTTPS outbound from your managed instances. See More

ArtisticAlalu's Experience

Pretty solid app design. It's not pretty but it just works once you figure it out. See More

Top Pro

Color coded dashboard

Instantly shows who has access to what server groups in color (red for root/sudo access, green for regular user, and white/none for no access.) See More

SensibleAmatsuMikaboshi's Experience

Very very fast and easy to use. Does just enough without too much. See More

Top Pro

If central servers go down, you can still log in

Even if the userify servers go down, you can still log in with your private key. See More

MagicalBalor's Experience

Userify is fantastic in an operations environment on EC2. We deploy their agent (they call it the shim) in less than a second on our AWS instances and it just works, really well. Very solid. Huge fan of the architecture and stability. It's free up to 20 servers (24x7 over a month), but we blew through 20 servers pretty fast. The price after that is a fraction of a penny per hour per server and there's no extra charges for keys, users, or anything else. Please note that this is a professional tool for professional devops, engineers, and solution architects. See More

Top Pro

Available in self-hosted and Cloud, in single-server and clustered modes

Cloud is available for free up to 20 servers, while self-hosted is limited to five servers free. See More

DeliberateVanapagan's Experience

Userify isn't cheap once you get past the free tier (which is pretty generous -- 20 servers free!) but it's probably the best option out there.. definitely the fastest to get up and running with, and seems to be extremely focused on security. Also, I very much appreciate the grouping of servers, since we have hundreds of servers in some groups and it wouldn't make any sense to manage users on each server individually like some of the other tools. I'm a fan for sure, but I would add one feature request -- the ability to configure groups on a per-server group basis. The support team (also very fast and helpful, by the way) says that's coming soon. Overall, I give it a 10 out of 10. See More

Top Pro

Can handle tens of thousands of servers in a cluster configuration

Handles thousands of servers hassle-free using an AWS EC2 cluster. See More

SuaveNinsusinak's Experience

Userify is very easy to use and I was up and running very quickly. See More

Top Pro

Compartmentalization/isolation

Users are isolated in what they can see. If a user doesn't have access to a server group, project, or company, they can't see any of its parts -- not even the project or server group names or who has access. See More

ImmaculateBres's Experience

Userify just works. It's fast and easy and bulletproof. See More

Top Pro

Extremely fast to get started

Tip: click the word "None" to change user permissions. See More

ResponsiveOeyangganshin's Experience

Excellent tool. Really appreciate the color coding. See More

Top Pro

Built-in key scanner

Scans for unused keys (what Userify calls "loose" keys) and presents them on a per-server basis within each server groups. No additional configuration is needed, it just works out of the box. See More

LovelyAsopus's Experience

This is my favorite cloud SSH key manager.. It's very fast and easy to use and handles authorization (they call sudo permissions 'root', regular user accounts, or no access/login) and also supports a lot of different shells. The "public key" text box appears to be just an authorized_keys with whitelisted characters, so you can do anything there that you would normally do in an authorized keys, including restricted commands or whitelisted networks. Userify is highly recommended. See More

Top Pro

Free for up to 20 servers

It's completely free (no credit card needed) and can be used up to 20 servers, and this free tier does NOT expire. See More

Top Pro

Excellent and fast support

Support is fast and responsive, but more importantly, actually knows the product. See More

Top Pro

Pricing is based on per-server instead of per-user

This is great so you don't have to pay per key or per user, and it's easy to control your budget. See More

Top Pro

Let's Encrypt integration

Self-hosted Userify integrates with Let's Encrypt, providing instant SSL. See More

Top Pro

Key generator

Generates private keys, including both Mac/OSX/Linux RSA keys as well as Putty keys, and can even distribute those keys to end boxes (useful for automation accounts). See More

See All

score 9 · Answer 2

ManageEngine Key Manager Plus

Top Pro

Works on both Windows and Linux

Top Con

Clunky interface, time consuming to get up and running with

The key manager stores the keys directly inside the tool. It's an unusual choice and slows down deployment. Each key has to be individually associated with both a user and a server, which are not easily organized into groups. See More

MagicalBalor's Experience

This is a powerful tool but it was difficult and time consuming to deploy. See More

Specs

Platforms:Windows, Linux

Top Pro

Let's Encrypt Integration

Top Con

Time consuming to deploy, not a robust method of keeping updated

Top Pro

Free edition availability

Free for up to 5 keys. See More

See All

score 11 · Answer 3

SSH Universal Key Manager

Top Con

Doesn't work in the cloud

UKM doesn't work at all with auto-scaling groups or dynamic IP's. See More

Top Pro

Can log SSH commands

Other systems like Userify use other tools like auditd or Splunk to log commands, but SSH UKM has logging built in. See More

NiceAmergin's Experience

We moved away from this product a few months ago due to it being buggy. We experienced issues with performance and silly things like documentation not being clear enough. It feels pretty clunky and out of date and just overall wasn't a nice product to use. See More

Top Con

Expensive

UKM is extremely expensive versus the capabilities provided. See More

Top Pro

Detects and alerts on suspicious key activity

Top Con

Hard to scale

Only deals with single servers, not groups. Doesn't scale very well and very expensive to scale. See More

Top Pro

Scans and alerts on existing keys

Can scan your existing systems and find and remove old keys. See More

Top Con

Poor documentation

The documentation doesnt help much with anything but the minimum needed to get it working, things like common errors have no information. See More

Top Con

Time consuming and complex to install and configure

Extremely complex and requires substantial resources. See More

See All

score 11 · Answer 4

keyper

Top Con

Very expensive

Pricing os based on both users and servers, so you can't really control your bill very well. See More

Top Pro

Low price of entry

To quote their pricing page for commercial use: "Free for up to 20 servers and 5 users. $1/month for additional servers and users." All though a bit murky what does "additional servers and users" imply (does it mean extra 20 servers covered or 2000 servers? 5 more users for 1$/month or 500 for 5000$/month?) See More

score 4 · Answer 5

SSH KeyBox

Top Pro

Can audit sessions

Keybox can audit sessions on a historical basis, compared to Userify which requires that you use other tools (like auditd and greylog2) to do that. See More

Top Con

Keybox doesn't use real SSH, so things like remote automation and scp/sftp aren't possible

You may be able to manage those out of band, however, but they're not possible directly in the browser from your OpenSSH client. See More

Top Pro

Free and open source

SSH KeyBox is free and open source. The source code is hosted on GitHub and it's released under the Apache 2.0 License. See More

Top Con

Runs through the browser

KeyBox is browser-based and is accessed through a web browser. This adds some insecurity and potential attack vectors to the platform. See More

Top Pro

Acts as a bastion host

The ssh KeyBox server is its own bastion host. See More

See All

score 48 · Answer 6

5 Options Considered

My Recommendation for Userify

My Recommendation for Userify

Installs instantly

Only up to 20 servers are free (10 on self-hosted)

Built-in recipes for Ansible, Chef, Puppet, Terraform, Bash, and CloudFormation

The Userify shim doesn't yet support certain containers

Manages sudo permissions (root/user/none)

Pricey for small companies

When you remove a user, their keys are removed and sessions are KILLED

User interface is slow and clunky

Very reliable across multi-cloud and intermittent connections

Color coded dashboard

If central servers go down, you can still log in

Available in self-hosted and Cloud, in single-server and clustered modes

Can handle tens of thousands of servers in a cluster configuration

Compartmentalization/isolation

Extremely fast to get started

Built-in key scanner

Free for up to 20 servers

Excellent and fast support

Pricing is based on per-server instead of per-user

Let's Encrypt integration

Key generator

My Recommendation for ManageEngine Key Manager Plus

My Recommendation for ManageEngine Key Manager Plus

Works on both Windows and Linux

Clunky interface, time consuming to get up and running with

Let's Encrypt Integration

Time consuming to deploy, not a robust method of keeping updated

Free edition availability

My Recommendation for SSH Universal Key Manager

My Recommendation for SSH Universal Key Manager

Doesn't work in the cloud

Can log SSH commands

Expensive

Detects and alerts on suspicious key activity

Hard to scale

Scans and alerts on existing keys

Poor documentation

Time consuming and complex to install and configure

My Recommendation for keyper

My Recommendation for keyper

Very expensive

Low price of entry

My Recommendation for SSH KeyBox

My Recommendation for SSH KeyBox

Can audit sessions

Keybox doesn't use real SSH, so things like remote automation and scp/sftp aren't possible

Free and open source

Runs through the browser

Acts as a bastion host

Don't see your favorite option? Add it.

My Recommendation for ServerAuth SSH Access Management

My Recommendation for ServerAuth SSH Access Management

My Recommendation for Keystash

My Recommendation for Keystash

One sec!