Long-lived SSH keys and passwords increase risk because they create reusable credentials that can be stolen, copied, or left behind after a user no longer needs access. Passwords are vulnerable to brute force and interception, while static keys can persist unnoticed. Ephemeral, identity-based access reduces the chance that a compromised credential becomes a standing entry point.
Why This Matters for Security Teams
Long-lived SSH keys and password logins are risky because they turn server access into a reusable secret rather than a verified session. On Ubuntu fleets, that means one copied key, reused password, or stale account can survive far beyond the business need that created it. NHI Management Group’s Ultimate Guide to NHIs — Static vs Dynamic Secrets shows why static credentials become durable attack paths, while the OWASP Non-Human Identity Top 10 frames the broader risk of unmanaged, long-lived identity material.
The operational issue is not just theft. Password logins invite brute force, credential stuffing, and reuse across systems. SSH keys avoid some of that exposure, but if they are not time-bound, inventoried, and revoked, they still function as standing access. That creates a gap between who should have access and what the server will still accept. Current guidance increasingly treats access as something to prove at the moment of use, not something to trust indefinitely. In practice, many security teams discover the problem only after an old key or password has already been used to move laterally.
How It Works in Practice
The strongest pattern on Ubuntu is to reduce standing access and make every login deliberate. That usually means disabling password authentication where possible, using short-lived keys or certificates, and tying administrative access to an identity workflow that can be reviewed and revoked quickly. The Ultimate Guide to NHIs is useful here because it explains why static secrets persist in places teams forget, while NIST Cybersecurity Framework 2.0 reinforces the need for controlled access and continuous governance.
- Use SSH keys only with a clear ownership model and a defined rotation or expiry process.
- Prefer certificate-based or just-in-time access for administrators and automation accounts.
- Restrict direct root login and require privilege elevation after authentication.
- Track where keys are deployed, who approved them, and when they must be removed.
- Verify that stale accounts, shared keys, and backup credentials are not silently retaining access.
For teams managing higher-risk environments, the practical goal is to make access ephemeral enough that compromise has a short half-life. The more a credential can be copied and reused without reauthorization, the more it behaves like a standing back door. These controls tend to break down in legacy Ubuntu estates that still rely on shared admin accounts, manual key distribution, and patchwork exception handling.
Common Variations and Edge Cases
Tighter login control often increases administrative overhead, requiring organisations to balance reduced exposure against operational continuity. That tradeoff is especially visible on Ubuntu servers that support batch jobs, CI/CD runners, incident response jump hosts, or break-glass access. In those cases, passwordless access is still the direction of travel, but best practice is evolving rather than universal: the right answer may be short-lived certificates, scoped bastion access, or a temporary exception with strict logging.
There are also environments where SSH keys remain necessary, but the risk profile changes. Shared service accounts, unmanaged developer laptops, and long-lived vendor access all increase the chance that a key escapes the intended boundary. NHI Management Group’s research notes that Why NHI Security Matters Now is not theoretical, and the broader evidence base in 52 NHI Breaches Analysis shows how quickly a stale secret can become an attack path.
In short, the edge cases are not reasons to keep weak defaults. They are reasons to add expiry, provenance, and review so the exception does not become permanent access. The failure mode is usually not a single bad login method, but a quiet accumulation of credentials that nobody is actively governing.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Static SSH secrets are unmanaged NHI credentials and increase exposure. |
| OWASP Agentic AI Top 10 | Ephemeral access and runtime authorization align with dynamic identity risk. | |
| CSA MAESTRO | Supports governed, low-standing-privilege access for autonomous workloads. | |
| NIST AI RMF | Risk governance applies when access decisions depend on context and runtime behaviour. | |
| NIST CSF 2.0 | PR.AA-01 | Strong identity authentication and access control reduce SSH login risk. |
Inventory all SSH keys and passwords, then remove standing access that lacks ownership or expiry.
Related resources from NHI Mgmt Group
- Why do long-lived API secrets and access tokens increase operational risk in identity automation?
- Why do long-lived API keys create more risk than scoped OAuth 2.0 client credentials for machine-to-machine access?
- Why do non-human identities create more access risk when permissions are static and long lived?
- Why does SSH password authentication create higher risk for privileged accounts and admin access?
