When someone leaves a team, three things matter: they stop getting new changes, they can't read anything added after they left, and the secrets they could see stop working. MorphGate walks you through all three.
What removal can and can't do
Removing someone stops their sync and, after a key rotation, keeps them out of anything written from then on. It can't take back what they already synced: their devices keep the copies they had. That's why the last steps change the passwords and keys they could see.
Remove a member with offboarding
Owners and admins remove confirmed members from the app. Only the owner removes admins. In the team's member list, choose Remove… next to the person. MorphGate opens four steps.
1. What they can open
Each vault they have access to, their access level, and how many hosts, SSH keys, VPNs and other items it holds.
2. Remove and rotate
Choose Remove (with their address) and rotate keys. MorphGate removes them from the team, then gives each of those vaults a new key, sealed to everyone who still has access. If a rotation is interrupted, Rotate the rest finishes the job. When it's done, the page says every vault they had has a new key.
3. Their SSH keys on your hosts
If they published the SSH keys they use on the team's servers (see below), MorphGate can find and remove them.
- Choose Check hosts. MorphGate signs in to every host in the team's vaults, as each host is saved, and looks for their keys in
~/.ssh/authorized_keys. - Each host shows how many of their keys it found, or the problem it ran into.
- Choose Remove from (the number of hosts). MorphGate removes those lines and replaces the file in one step over SFTP.
If they published no keys, the app can't tell which lines are theirs. Check the hosts by hand.
4. Change what they could see
A checklist of every saved password, SSH key and VPN profile in those vaults. Tick each one as you change it.
For a shared SSH key, Replace key does the work for you:
- MorphGate generates a new key and adds it to every host that signs in with the old one, and tries it there.
- Then the vault switches to the new key.
- Then the old key is removed from those hosts.
If any host fails before the switch, nothing changes. If the old key couldn't be removed somewhere, the list says where it's still installed.
Removing without offboarding
- People who accepted but weren't confirmed yet have nothing to rotate. Remove takes them off the list.
- Owners and admins can also remove members on the team page at morphgate.com. That removes them but doesn't rotate keys or clean hosts. Rotate the keys of their vaults in the app afterwards.
- Your identity provider can remove people over SCIM (Business). Their vaults are flagged for a key rotation the same way.
- Taking someone's access to one vault, or making an admin a member, flags the affected vaults too.
Rotating a key by hand
Whenever someone loses access, the vault shows someone lost access since the key was made, and the sidebar shows Teams · rotate a key to anyone who manages that vault. Choose Rotate key next to the vault.
Rotation seals the new key to everyone with access, owners and admins included, then re-encrypts the vault's items under it. Once the key has changed, the server refuses changes made with the old key. If a device is interrupted while re-encrypting, any member with edit access finishes it at their next sync. Older items stay readable for members with the older keys until they're re-encrypted.
Publishing your SSH keys
For step 3 to work, members publish the public halves of the SSH keys they use on the team's servers. Only the public key is shared.
- Open the team in Teams.
- Under Your SSH keys, pick a key under Publish one of your keys… and choose Publish.
The list shows your published keys; Unpublish withdraws one. You can publish keys from your personal vault. Each entry is signed by you, so nobody else, the server included, can publish a key in your name.
The published keys live in a special team vault every confirmed member can write to, shown as Every member, with Members' SSH public keys. It's created by the first owner's or admin's app that needs it, and arrives at the next sync.