GoTerm
Menu
Get started
All guides

Keys, people and security

One key for every host that needs it

The Vault keeps passwords and private keys once, sealed, for the hosts that use them. Yours stay yours; a team’s are used by its members, who never see them.

Updated

On this page
  1. How the Vault works
  2. Make or import a key
  3. Put a key on hosts
  4. Replace or move a key
  5. Check known hosts
  6. Confirm and remove devices
  7. Your keys on your desktops
  8. More on keys
  9. Good to know

How the Vault works

Each password or key belongs to a space: yours, or a team’s. Any host of that space can use it, so a new key reaches all of them at once.

On-call deploy keymembers use it, never see itweb-01Productionweb-02Productionk8s-ctlProduction
The On-call team’s deploy key, used by three of the team’s hosts. The team’s members connect with it but never see it.
  • Replace a key once, and every host that uses it gets the new one.
  • A team’s members connect with its keys without ever seeing them.
  • Nobody gets a saved secret back. A key of yours that GoTerm makes can be downloaded once, as it’s made.

Make or import a key

  1. Open Vault and choose New key.
  2. Choose Make one, or Import mine and paste or pick your key.
  3. Name it, and pick its Space: yours, or a team’s.
  4. For your own key, tick Download a copy of the private key to keep one.
  5. Choose Make the key or Save the key.

Tip: Made a key? Copy the public key it shows into each server’s authorized_keys.

The New key dialog: Make one, the name Staging deploy key, the On-call team’s space, and the ED25519 type.Open the full-size picture

Put a key on hosts

  1. Edit a host, or choose New host.
  2. Under Auth method pick Private key, then the key under Saved key.
  3. Choose Save. Any host of the same space can use the same key.
  4. On the key’s … menu, Copy the public key for the server’s authorized_keys.
The Vault’s Keys tab: each team’s deploy key and a personal key, each with its fingerprint and the hosts that use it.Open the full-size picture

Replace or move a key

  1. On the key’s … menu, choose Replace with another key, and paste the new one.
  2. Every host that uses it switches at once.
  3. To hand a key of yours to a team, choose Move to a team. Its hosts go along.

Tip: Passwords work the same way, under Passwords, with Change the password.

Check known hosts

GoTerm remembers each server’s host key the first time it connects, and refuses to connect if the key changes.

  1. Open Vault, then Known hosts.
  2. A server was rebuilt, so its key changed? Choose Forget on its row.
  3. Connect again, and GoTerm remembers the new key.
The Vault’s Known hosts tab: each server’s address, its space, the key’s SHA256 fingerprint, and a Forget button.Open the full-size picture

Confirm and remove devices

Every browser and computer you sign in from is a device. A new one waits until you confirm it.

  1. Open Vault, then Devices.
  2. A device is waiting? Choose Confirm only if you know it’s yours.
  3. Lost a laptop? Choose Remove on its … menu. It’s signed out at once.
The Vault’s Devices tab: Personal sync switched on, and two devices, a browser and a MacBook, with where and when each signed in.Open the full-size picture

Your keys on your desktops

Your own passwords and keys go to the desktop apps you confirmed, sealed for each one, so Direct mode can use them. A team’s never leave GoTerm.

Your keyin the VaultSealedfor that one desktopYour desktop appopens it to connect
A personal key in the Vault is sealed for one confirmed desktop and sent to it; only that desktop app can open it, to connect.
  • Only desktops you confirmed receive anything. A browser never does.
  • Remove a desktop, and it deletes its copies when it next comes online.
  • Admins can turn Personal sync off for the whole organization.

More on keys

  • Agent forwardingUse your keys from a server you’re signed in to, without copying them there.
  • Certificates and FIDO2 keysSign in with SSH certificates, or with a hardware key you touch to connect.

Good to know

  • A key that hosts use can’t be deleted until you take it off them.
  • Key names are unique in their space.
  • Every change to a saved password or key is in the audit log, with who made it.

Didn’t find your answer?

Write to us, and an engineer who builds GoTerm will reply.

Ask an engineer