Questionnaire PDF· Free Report ·
10 questions: who can log into your Linux systems
Accounts get deprovisioned. Keys usually don't, they don't expire, and nothing in a normal review cycle looks at them. Ten questions to work through with your team.
Access reviews look at accounts. Keys aren't accounts.
A key on a production host doesn't sit in your identity system, doesn't expire, and doesn't care whether the person who created it still works here. It's a line in a file, added by someone solving a problem, and it stays until somebody removes it.
The Questions
- How many authorized_keys files exist across your Linux environment, and when did anyone last read them?
- Can you name the current person, system or contract behind every key that grants access to production?
- How many of your keys belong to automation, scripts, CI, backup jobs, and who owns each one now?
- When was the last time your team audited your Linux environment for weak and default passwords?
- Are any private keys used to access the environment stored unencrypted, on laptops, or in shared locations?
- Is password authentication still enabled anywhere in your environment, and how do you know?
- How many accounts can reach the root of a production host and do you have a process for product host approval?
- How many Linux hosts do you have, and does that match the number in your asset inventory?
- What is your process for revoking key access when one of your staff leaves, and when did you last run it?
- If a new key were added to a production host tomorrow, how would you find out?
Get started:
The ten internal questions as a worksheet your team can work through host by host. Comes with Keys to the Vault, our report on how SSH key access and password authentication persist on Linux systems that have passed audit.
REPORT: Keys to the Vault
Fill in the form to get our new report on what SSH key access actually looks like on Linux systems that had already passed audit. Keys that
outlived the people who created them, password authentication still enabled on hosts nobody claimed, and why access reviews structurally
miss both. Free, alongside the questionnaire.
Full security visibility on Linux, zero footprint.
Sandfly connects over SSH, hunts for intruders and malware around the clock, and gathers the forensic evidence
your team needs to act.
