---
title: Password Vault SSH Key Rotation
slug: kronpam-reference-guide-3-9-0/password-vault-ssh-key-rotation
description: Learn how to enhance security in SAPM by adding an SSH key to prevent unauthorized access. Follow these step-by-step instructions to configure SSH Key settings, establish an SSH connection, and save the account. Keep your dynamic accounts periodically cha
docTags: 
createdAt: 2022-07-29T09:07:12.000Z
---

The Password Vault changes and rotates privileged account passwords, but users who have downloaded private keys for their accounts continue logging in to target devices with those keys. To prevent this, the Password Vault can also change SSH keys periodically.

The Password Vault supports the RSA, DSA, ECDSA, ED25519, and ECDH cryptographic algorithms for key operations. You can customize the lengths of these algorithms within the Password Vault; review and control the Vault Configuration settings that manage these algorithm lengths.

To add an SSH key to the Password Vault:

1. Navigate to **Secrets** > **Vault**.
2. Open the **Vault** tab.
3. Click **+Add** and select **Add Account**.
4. Enter the **Host**, **Change Period**, and **Username**.
5. Select one of the SSH key types as the **Configuration**. This changes the **Password** field to an **RSA Private Key** field.
6. Establish an SSH connection to the target device and copy the contents of the */home//.ssh/id\_rsa* file (or any other path that contains the user's RSA private key).
7. Paste the file contents into the **RSA Private Key** field.
8. Click **Save**.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Xl6wypa6ivVCJQfe4lUM__image.png" size="70" caption="Figure - SSH Key defining in the Password Vault Accounts page" isUploading="false" width="748" height="1071" darkWidth="748" darkHeight="1071" showCaption="true"}

Kron PAM saves and lists the Password Vault account in the Password Vault Accounts section. From this point on, if the account type is dynamic, the SSH key changes periodically. If the account type is static, the SSH key stays unchanged.

Checking out and resetting the SSH key works like any other Password Vault account.

You can also discover new users on the target device using the SSH key. This feature works the same as with other strategies; see [Discover New Users](docId\:SvXoViHoVIQccC7nZEbEh), for details.