Add SSH key pair management tasks

Add generate_ssh_key, get_ssh_key, and revoke_ssh_key task types to
enable direct SSH access to an Edgebox instance. The generate task
creates an ED25519 key pair, installs the public key in authorized_keys,
and stores both keys plus the fingerprint in the option table. The
revoke task removes the key pair from disk, purges it from
authorized_keys, and clears the stored options.

CHANGELOG.md

@@ -1,12 +1,5 @@
 # Changelog
 
-## [1.4.0] - 23-09-2026
-
-* Added dashboard-managed SSH public-key access.
-* Validates ED25519 public keys and reports their SHA256 fingerprints.
-* Atomically installs or removes only the marked Edgebox key while preserving all other authorized keys.
-* Never generates, reads, stores, logs, or returns SSH private keys.
-
 ## [1.3.2] - 08-12-2024
 
 * Fix to Browser Dev feature:
@@ -27,3 +20,4 @@
 ### Missing Past Releases
 
 Release notes for past versions are not available in this file. Please refer to the [GitHub releases](https://hithub.com/edgebox-iot/edgeboxctl/releases) for more information. Feel free to contribute to this file by adding missing release notes.
+

internal/tasks/ssh_access.go

@@ -1,217 +0,0 @@
-package tasks
-
-import (
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/binary"
-	"encoding/json"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-
-	"github.com/edgebox-iot/edgeboxctl/internal/utils"
-)
-
-const (
-	sshDirectory      = "/root/.ssh"
-	managedSSHComment = "edgebox-dashboard-managed"
-)
-
-type sshAccessResult struct {
-	Status      string `json:"status"`
-	PublicKey   string `json:"public_key,omitempty"`
-	Fingerprint string `json:"fingerprint,omitempty"`
-}
-
-func taskEnableSSHAccess(args taskEnableSSHAccessArgs) (string, error) {
-	if err := verifyRootSSHAccess(); err != nil {
-		return "", err
-	}
-
-	publicKey, fingerprint, err := parseSSHEd25519PublicKey(args.PublicKey)
-	if err != nil {
-		return "", err
-	}
-
-	if err := reconcileManagedSSHKey(sshDirectory, publicKey); err != nil {
-		return "", err
-	}
-
-	utils.WriteOption("SSH_ACCESS_ENABLED", "true")
-	utils.WriteOption("SSH_PUBLIC_KEY", publicKey)
-	utils.WriteOption("SSH_KEY_FINGERPRINT", fingerprint)
-
-	result, err := json.Marshal(sshAccessResult{
-		Status:      "enabled",
-		PublicKey:   publicKey,
-		Fingerprint: fingerprint,
-	})
-	if err != nil {
-		return "", err
-	}
-
-	return string(result), nil
-}
-
-func taskDisableSSHAccess() (string, error) {
-	if err := reconcileManagedSSHKey(sshDirectory, ""); err != nil {
-		return "", err
-	}
-
-	utils.WriteOption("SSH_ACCESS_ENABLED", "false")
-	utils.DeleteOption("SSH_PUBLIC_KEY")
-	utils.DeleteOption("SSH_KEY_FINGERPRINT")
-
-	result, err := json.Marshal(sshAccessResult{Status: "disabled"})
-	if err != nil {
-		return "", err
-	}
-
-	return string(result), nil
-}
-
-func parseSSHEd25519PublicKey(input string) (string, string, error) {
-	trimmed := strings.TrimSpace(input)
-	if trimmed == "" || strings.ContainsAny(trimmed, "\r\n") {
-		return "", "", fmt.Errorf("provide exactly one SSH public key")
-	}
-
-	fields := strings.Fields(trimmed)
-	if len(fields) < 2 || len(fields) > 3 || fields[0] != "ssh-ed25519" {
-		return "", "", fmt.Errorf("only one ssh-ed25519 public key is supported")
-	}
-
-	keyBlob, err := base64.StdEncoding.DecodeString(fields[1])
-	if err != nil || !validEd25519KeyBlob(keyBlob) {
-		return "", "", fmt.Errorf("invalid ssh-ed25519 public key")
-	}
-
-	digest := sha256.Sum256(keyBlob)
-	publicKey := "ssh-ed25519 " + base64.StdEncoding.EncodeToString(keyBlob) + " " + managedSSHComment
-	fingerprint := "SHA256:" + base64.RawStdEncoding.EncodeToString(digest[:])
-
-	return publicKey, fingerprint, nil
-}
-
-func validEd25519KeyBlob(blob []byte) bool {
-	if len(blob) < 4 {
-		return false
-	}
-
-	typeLength := int(binary.BigEndian.Uint32(blob[:4]))
-	if typeLength != len("ssh-ed25519") || len(blob) < 4+typeLength+4 {
-		return false
-	}
-	if string(blob[4:4+typeLength]) != "ssh-ed25519" {
-		return false
-	}
-
-	keyLengthOffset := 4 + typeLength
-	keyLength := int(binary.BigEndian.Uint32(blob[keyLengthOffset : keyLengthOffset+4]))
-	return keyLength == 32 && len(blob) == keyLengthOffset+4+keyLength
-}
-
-func reconcileManagedSSHKey(directory string, publicKey string) error {
-	if info, err := os.Lstat(directory); err == nil {
-		if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
-			return fmt.Errorf("SSH directory is not a regular directory")
-		}
-	} else if !os.IsNotExist(err) {
-		return fmt.Errorf("inspect SSH directory: %w", err)
-	} else if err := os.MkdirAll(directory, 0700); err != nil {
-		return fmt.Errorf("create SSH directory: %w", err)
-	}
-
-	if err := os.Chmod(directory, 0700); err != nil {
-		return fmt.Errorf("secure SSH directory: %w", err)
-	}
-
-	authorizedKeysPath := filepath.Join(directory, "authorized_keys")
-	if info, err := os.Lstat(authorizedKeysPath); err == nil && info.Mode()&os.ModeSymlink != 0 {
-		return fmt.Errorf("authorized_keys must not be a symbolic link")
-	} else if err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("inspect authorized_keys: %w", err)
-	}
-
-	existing, err := os.ReadFile(authorizedKeysPath)
-	if err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("read authorized_keys: %w", err)
-	}
-
-	lines := strings.Split(string(existing), "\n")
-	kept := make([]string, 0, len(lines)+1)
-	for _, line := range lines {
-		if strings.TrimSpace(line) == "" || isManagedSSHKey(line) {
-			continue
-		}
-		kept = append(kept, line)
-	}
-	if publicKey != "" {
-		kept = append(kept, publicKey)
-	}
-
-	contents := ""
-	if len(kept) > 0 {
-		contents = strings.Join(kept, "\n") + "\n"
-	}
-
-	temporary, err := os.CreateTemp(directory, ".authorized_keys-*")
-	if err != nil {
-		return fmt.Errorf("create authorized_keys temporary file: %w", err)
-	}
-	temporaryPath := temporary.Name()
-	defer os.Remove(temporaryPath)
-
-	if err := temporary.Chmod(0600); err != nil {
-		temporary.Close()
-		return fmt.Errorf("secure authorized_keys temporary file: %w", err)
-	}
-	if _, err := temporary.WriteString(contents); err != nil {
-		temporary.Close()
-		return fmt.Errorf("write authorized_keys: %w", err)
-	}
-	if err := temporary.Sync(); err != nil {
-		temporary.Close()
-		return fmt.Errorf("sync authorized_keys: %w", err)
-	}
-	if err := temporary.Close(); err != nil {
-		return fmt.Errorf("close authorized_keys: %w", err)
-	}
-	if err := os.Rename(temporaryPath, authorizedKeysPath); err != nil {
-		return fmt.Errorf("replace authorized_keys: %w", err)
-	}
-
-	return nil
-}
-
-func isManagedSSHKey(line string) bool {
-	fields := strings.Fields(line)
-	return len(fields) == 3 && fields[2] == managedSSHComment
-}
-
-func verifyRootSSHAccess() error {
-	sshdPath, err := exec.LookPath("sshd")
-	if err != nil {
-		sshdPath = "/usr/sbin/sshd"
-		if _, statErr := os.Stat(sshdPath); statErr != nil {
-			return fmt.Errorf("OpenSSH server is not installed")
-		}
-	}
-
-	output, err := exec.Command(sshdPath, "-T").Output()
-	if err != nil {
-		return fmt.Errorf("could not verify the effective SSH server configuration")
-	}
-
-	settings := string(output)
-	if !strings.Contains(settings, "pubkeyauthentication yes") {
-		return fmt.Errorf("SSH public-key authentication is disabled")
-	}
-	if strings.Contains(settings, "permitrootlogin no") {
-		return fmt.Errorf("SSH root login is disabled")
-	}
-
-	return nil
-}

internal/tasks/ssh_access_test.go

@@ -1,111 +0,0 @@
-package tasks
-
-import (
-	"encoding/base64"
-	"encoding/binary"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func testPublicKey(t *testing.T) string {
-	t.Helper()
-	blob := make([]byte, 4+len("ssh-ed25519")+4+32)
-	binary.BigEndian.PutUint32(blob[:4], uint32(len("ssh-ed25519")))
-	copy(blob[4:], "ssh-ed25519")
-	offset := 4 + len("ssh-ed25519")
-	binary.BigEndian.PutUint32(blob[offset:offset+4], 32)
-	for index := 0; index < 32; index++ {
-		blob[offset+4+index] = byte(index + 1)
-	}
-	return "ssh-ed25519 " + base64.StdEncoding.EncodeToString(blob) + " workstation"
-}
-
-func TestParseSSHEd25519PublicKey(t *testing.T) {
-	publicKey, fingerprint, err := parseSSHEd25519PublicKey(testPublicKey(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.HasSuffix(publicKey, " "+managedSSHComment) {
-		t.Fatalf("public key does not have managed marker: %q", publicKey)
-	}
-	if !strings.HasPrefix(fingerprint, "SHA256:") {
-		t.Fatalf("unexpected fingerprint: %q", fingerprint)
-	}
-}
-
-func TestParseSSHEd25519PublicKeyRejectsUnsafeInput(t *testing.T) {
-	inputs := []string{
-		"",
-		"-----BEGIN OPENSSH PRIVATE KEY-----",
-		testPublicKey(t) + "\n" + testPublicKey(t),
-		"command=whoami " + testPublicKey(t),
-		"ssh-rsa AAAA invalid",
-	}
-	for _, input := range inputs {
-		if _, _, err := parseSSHEd25519PublicKey(input); err == nil {
-			t.Fatalf("expected input to be rejected: %q", input)
-		}
-	}
-}
-
-func TestReconcileManagedSSHKeyPreservesUnrelatedKeys(t *testing.T) {
-	directory := t.TempDir()
-	authorizedKeysPath := filepath.Join(directory, "authorized_keys")
-	original := "# operator key\nssh-ed25519 AAAAoperator operator\n"
-	if err := os.WriteFile(authorizedKeysPath, []byte(original), 0644); err != nil {
-		t.Fatal(err)
-	}
-
-	publicKey, _, err := parseSSHEd25519PublicKey(testPublicKey(t))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := reconcileManagedSSHKey(directory, publicKey); err != nil {
-		t.Fatal(err)
-	}
-	if err := reconcileManagedSSHKey(directory, publicKey); err != nil {
-		t.Fatal(err)
-	}
-
-	contents, err := os.ReadFile(authorizedKeysPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Count(string(contents), managedSSHComment) != 1 {
-		t.Fatalf("managed key is not idempotent: %s", contents)
-	}
-	if !strings.Contains(string(contents), original) {
-		t.Fatalf("unrelated content was changed: %s", contents)
-	}
-	if info, err := os.Stat(authorizedKeysPath); err != nil || info.Mode().Perm() != 0600 {
-		t.Fatalf("authorized_keys mode is not 0600: %v, %v", info, err)
-	}
-
-	if err := reconcileManagedSSHKey(directory, ""); err != nil {
-		t.Fatal(err)
-	}
-	contents, err = os.ReadFile(authorizedKeysPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(contents) != original {
-		t.Fatalf("disable changed unrelated content: %q", contents)
-	}
-}
-
-func TestReconcileManagedSSHKeyRejectsSymlink(t *testing.T) {
-	directory := t.TempDir()
-	target := filepath.Join(directory, "target")
-	if err := os.WriteFile(target, []byte("preserve me"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Symlink(target, filepath.Join(directory, "authorized_keys")); err != nil {
-		t.Fatal(err)
-	}
-
-	if err := reconcileManagedSSHKey(directory, ""); err == nil {
-		t.Fatal("expected symlink to be rejected")
-	}
-}

internal/tasks/tasks.go

@@ -1,16 +1,16 @@
 package tasks
 
 import (
-	"bufio"
 	"database/sql"
 	"encoding/json"
 	"fmt"
 	"log"
-	"os"
-	"os/exec"
 	"strconv"
-	"strings"
 	"time"
+	"os/exec"
+	"strings"
+	"os"
+	"bufio"
 
 	"github.com/edgebox-iot/edgeboxctl/internal/diagnostics"
 	"github.com/edgebox-iot/edgeboxctl/internal/edgeapps"
@@ -114,9 +114,6 @@ type taskSetBrowserDevPasswordArgs struct {
 	Password string `json:"password"`
 }
 
-type taskEnableSSHAccessArgs struct {
-	PublicKey string `json:"public_key"`
-}
 
 const STATUS_CREATED int = 0
 const STATUS_EXECUTING int = 1
@@ -300,6 +297,21 @@ func ExecuteTask(task Task) Task {
 			taskResult := taskStopShell()
 			task.Result = sql.NullString{String: taskResult, Valid: true}
 
+		case "generate_ssh_key":
+			log.Println("Generating SSH Key...")
+			taskResult := taskGenerateSshKey()
+			task.Result = sql.NullString{String: taskResult, Valid: true}
+
+		case "get_ssh_key":
+			log.Println("Getting SSH Key...")
+			taskResult := taskGetSshKey()
+			task.Result = sql.NullString{String: taskResult, Valid: true}
+
+		case "revoke_ssh_key":
+			log.Println("Revoking SSH Key...")
+			taskResult := taskRevokeSshKey()
+			task.Result = sql.NullString{String: taskResult, Valid: true}
+
 		case "activate_browser_dev":
 			log.Println("Activating Browser Dev Environment")
 			taskResult := taskActivateBrowserDev()
@@ -487,27 +499,6 @@ func ExecuteTask(task Task) Task {
 			taskResult := taskDeactivateBrowserDev()
 			task.Result = sql.NullString{String: taskResult, Valid: true}
 
-		case "enable_ssh_access":
-			log.Println("Installing dashboard-managed SSH public key...")
-			var args taskEnableSSHAccessArgs
-			if err := json.Unmarshal([]byte(task.Args.String), &args); err != nil {
-				task.Result = sql.NullString{String: "invalid SSH access task arguments", Valid: false}
-			} else if taskResult, err := taskEnableSSHAccess(args); err != nil {
-				log.Printf("Error enabling SSH access: %s", err)
-				task.Result = sql.NullString{String: err.Error(), Valid: false}
-			} else {
-				task.Result = sql.NullString{String: taskResult, Valid: true}
-			}
-
-		case "disable_ssh_access":
-			log.Println("Removing dashboard-managed SSH public key...")
-			if taskResult, err := taskDisableSSHAccess(); err != nil {
-				log.Printf("Error disabling SSH access: %s", err)
-				task.Result = sql.NullString{String: err.Error(), Valid: false}
-			} else {
-				task.Result = sql.NullString{String: taskResult, Valid: true}
-			}
-
 		}
 
 	}
@@ -531,11 +522,7 @@ func ExecuteTask(task Task) Task {
 
 	} else {
 		fmt.Println("Error executing task with result: " + task.Result.String)
-		errorResult := task.Result.String
+		_, err = statement.Exec(STATUS_ERROR, "Error", formatedDatetime, strconv.Itoa(task.ID)) // Execute SQL Statement with Error info
-		if errorResult == "" {
-			errorResult = "Error"
-		}
-		_, err = statement.Exec(STATUS_ERROR, errorResult, formatedDatetime, strconv.Itoa(task.ID)) // Execute SQL Statement with Error info
 		if err != nil {
 			log.Fatal(err.Error())
 		}
@@ -784,6 +771,7 @@ func taskBackup() string {
 	fmt.Println(key_secret_name)
 	os.Setenv(key_secret_name, backup_repository_secret_access_key)
 
+
 	utils.WriteOption("BACKUP_IS_WORKING", "1")
 
 	// ...	This backs up the restic repository
@@ -846,6 +834,7 @@ func taskRestoreBackup() string {
 	fmt.Println(key_secret_name)
 	os.Setenv(key_secret_name, backup_repository_secret_access_key)
 
+
 	utils.WriteOption("BACKUP_IS_WORKING", "1")
 
 	fmt.Println("Stopping All EdgeApps")
@@ -854,8 +843,8 @@ func taskRestoreBackup() string {
 
 	// Copy all files in /home/system/components/apps/ to a backup folder
 	fmt.Println("Copying all files in /home/system/components/apps/ to a backup folder")
-	os.MkdirAll(utils.GetPath(utils.EdgeAppsBackupPath+"temp/"), 0777)
+	os.MkdirAll(utils.GetPath(utils.EdgeAppsBackupPath + "temp/"), 0777)
-	system.CopyDir(utils.GetPath(utils.EdgeAppsPath), utils.GetPath(utils.EdgeAppsBackupPath+"temp/"))
+	system.CopyDir(utils.GetPath(utils.EdgeAppsPath), utils.GetPath(utils.EdgeAppsBackupPath + "temp/"))
 
 	fmt.Println("Removing all files in /home/system/components/apps/")
 	os.RemoveAll(utils.GetPath(utils.EdgeAppsPath))
@@ -878,7 +867,7 @@ func taskRestoreBackup() string {
 	if strings.Contains(result, "Fatal:") {
 		// Copy all files from backup folder to /home/system/components/apps/
 		os.MkdirAll(utils.GetPath(utils.EdgeAppsPath), 0777)
-		system.CopyDir(utils.GetPath(utils.EdgeAppsBackupPath+"temp/"), utils.GetPath(utils.EdgeAppsPath))
+		system.CopyDir(utils.GetPath(utils.EdgeAppsBackupPath + "temp/"), utils.GetPath(utils.EdgeAppsPath))
 
 		fmt.Println("Error restoring backup: ")
 		utils.WriteOption("BACKUP_STATUS", "error")
@@ -1021,14 +1010,14 @@ func taskSetupTunnel(args taskSetupTunnelArgs) string {
 		system.CreateTunnel("/home/system/.cloudflared/config.yml")
 
 		fmt.Println("Creating DNS Routes for @ and *.")
-		cmd = exec.Command("cloudflared", "tunnel", "route", "dns", "-f", "edgebox", "*."+args.DomainName)
+		cmd = exec.Command("cloudflared", "tunnel", "route", "dns", "-f" ,"edgebox", "*." + args.DomainName)
 		cmd.Start()
 		err = cmd.Wait()
 		if err != nil {
 			log.Fatal(err)
 		}
 
-		cmd = exec.Command("cloudflared", "tunnel", "route", "dns", "-f", "edgebox", args.DomainName)
+		cmd = exec.Command("cloudflared", "tunnel", "route", "dns", "-f" ,"edgebox", args.DomainName)
 		cmd.Start()
 		err = cmd.Wait()
 		if err != nil {
@@ -1328,6 +1317,7 @@ func taskSetEdgeAppOptions(args taskSetEdgeAppOptionsArgs) string {
 	// Id is the edgeapp id
 	appID := args.ID
 
+
 	// Open the file to write the options,
 	// it is an env file in /home/system/components/apps/<app_id>/edgeapp.env
 
@@ -1378,6 +1368,7 @@ func taskSetEdgeAppBasicAuth(args taskSetEdgeAppBasicAuthArgs) string {
 	// Id is the edgeapp id
 	appID := args.ID
 
+
 	// Open the file to write the options,
 	// it is an env file in /home/system/components/apps/<app_id>/auth.env
 
@@ -1609,3 +1600,118 @@ func taskStartWs() {
 	fmt.Println("Executing taskStartWs")
 	system.StartWs()
 }
+
+func taskGenerateSshKey() string {
+	fmt.Println("Executing taskGenerateSshKey")
+
+	keyPath := "/root/.ssh/id_ed25519"
+	pubKeyPath := keyPath + ".pub"
+
+	// Check if key already exists
+	if _, err := os.Stat(keyPath); os.IsNotExist(err) {
+		fmt.Println("SSH key not found, generating new ED25519 key pair...")
+		utils.Exec("/", "ssh-keygen", []string{"-t", "ed25519", "-f", keyPath, "-N", "", "-q"})
+	} else {
+		fmt.Println("SSH key already exists at " + keyPath)
+	}
+
+	// Read public key
+	pubKeyBytes, err := os.ReadFile(pubKeyPath)
+	if err != nil {
+		fmt.Println("Error reading public key: " + err.Error())
+		return "{\"status\": \"error\", \"message\": \"" + err.Error() + "\"}"
+	}
+	pubKey := string(pubKeyBytes)
+
+	// Read private key
+	privKeyBytes, err := os.ReadFile(keyPath)
+	if err != nil {
+		fmt.Println("Error reading private key: " + err.Error())
+		return "{\"status\": \"error\", \"message\": \"" + err.Error() + "\"}"
+	}
+	privKey := string(privKeyBytes)
+
+	// Also add public key to authorized_keys for root
+	utils.Exec("/", "sh", []string{"-c", "mkdir -p /root/.ssh && chmod 700 /root/.ssh"})
+	authorizedFile := "/root/.ssh/authorized_keys"
+	authorizedBytes, _ := os.ReadFile(authorizedFile)
+	authorizedContent := string(authorizedBytes)
+
+	// Only add if not already present
+	if !strings.Contains(authorizedContent, strings.TrimSpace(pubKey)) {
+		f, err := os.OpenFile(authorizedFile, os.O_APPEND|os.O_WRONLY, 0600)
+		if err == nil {
+			defer f.Close()
+			f.WriteString("\n" + pubKey)
+			fmt.Println("Added SSH public key to authorized_keys")
+		}
+	}
+
+	// Store in options for the API to read
+	utils.WriteOption("SSH_PUBLIC_KEY", strings.TrimSpace(pubKey))
+	utils.WriteOption("SSH_PRIVATE_KEY", privKey)
+	utils.WriteOption("SSH_KEY_FINGERPRINT", strings.TrimSpace(utils.Exec("/", "ssh-keygen", []string{"-lf", pubKeyPath, "-E", "sha256"})))
+
+	fmt.Println("SSH key stored in options")
+
+	return "{\"status\": \"ok\", \"public_key\": \"" + strings.TrimSpace(pubKey) + "\"}"
+}
+
+func taskGetSshKey() string {
+	fmt.Println("Executing taskGetSshKey")
+
+	pubKey := utils.ReadOption("SSH_PUBLIC_KEY")
+	fingerprint := utils.ReadOption("SSH_KEY_FINGERPRINT")
+
+	if pubKey == "" {
+		// Try to read from filesystem directly
+		return taskGenerateSshKey()
+	}
+
+	return "{\"status\": \"ok\", \"public_key\": \"" + pubKey + "\", \"fingerprint\": \"" + fingerprint + "\"}"
+}
+
+func taskRevokeSshKey() string {
+	fmt.Println("Executing taskRevokeSshKey")
+
+	keyPath := "/root/.ssh/id_ed25519"
+	pubKeyPath := keyPath + ".pub"
+
+	// Read current public key before deletion
+	var pubKeyForRemoval string
+	if bytes, err := os.ReadFile(pubKeyPath); err == nil {
+		pubKeyForRemoval = strings.TrimSpace(string(bytes))
+	}
+
+	// Remove SSH key pair from filesystem
+	if err := os.Remove(keyPath); err != nil {
+		fmt.Println("Warning: could not remove private key: " + err.Error())
+	}
+	if err := os.Remove(pubKeyPath); err != nil {
+		fmt.Println("Warning: could not remove public key: " + err.Error())
+	}
+
+	// Remove the public key from authorized_keys if present
+	if pubKeyForRemoval != "" {
+		authorizedFile := "/root/.ssh/authorized_keys"
+		if bytes, err := os.ReadFile(authorizedFile); err == nil {
+			lines := strings.Split(string(bytes), "\n")
+			newLines := []string{}
+			for _, line := range lines {
+				if strings.TrimSpace(line) != pubKeyForRemoval {
+					newLines = append(newLines, line)
+				}
+			}
+			_ = os.WriteFile(authorizedFile, []byte(strings.Join(newLines, "\n")), 0600)
+		}
+	}
+
+	// Remove SSH options from DB
+	utils.WriteOption("SSH_PUBLIC_KEY", "")
+	utils.WriteOption("SSH_PRIVATE_KEY", "")
+	utils.WriteOption("SSH_KEY_FINGERPRINT", "")
+
+	fmt.Println("SSH key pair revoked")
+
+	return "{\"status\": \"ok\", \"message\": \"SSH key pair revoked\"}"
+}