Episode Details

Should you generate a dedicated SSH key for every server you manage, or reuse one key everywhere? This episode breaks down the real security tradeoffs — blast radius vs. operational friction — and shows how ssh-agent, Host blocks, and password manager backends can make compartmentalization viable. We also tackle the new complication of AI agents that need SSH access: static keys in ephemeral environments, command restrictions, and when an SSH certificate authority actually makes sense. If you manage more than a handful of servers, this will change how you think about key hygiene.