Access Management
See who can log in to every Linux server from one place. Scan your fleet, offboard a person from all servers at once, and onboard new users with per-server roles. All data stays local.
Managing who can log in to a single server is easy from the SSH Management tab. But once you have 20 or 50 servers, it stops scaling: offboarding one teammate means opening every server, checking authorized_keys, and revoking their key one by one. Miss a single server and that person still has a way in. Access fixes this by scanning your whole fleet and showing you, in one screen, exactly who can reach which servers and what they can do once they're in.
The access map is built and stored locally on your computer. CtrlOps reads the authorized users on each server during a scan and keeps the results on your machine. None of it is sent to CtrlOps or any third party.
What Access does
- Scan every server at once and read who is authorized on each one.
- See every person across your fleet, with how many servers they can reach and how many give them sudo.
- Remove a person from one server without touching their access elsewhere.
- Offboard a person from all servers in a single action, with a type-to-confirm guard.
- Onboard a new person to many servers at once: paste their public key, pick the servers, and set a role per server.
- Re-scan on demand to refresh the picture after you change keys directly on a server.
- Export an audit snapshot of who can access what.
Scan your servers for the first time
The first time you open Access, it's empty until you run a scan.
Open Access
Open app → Click Access (left sidebar, marked NEW)
You'll see the empty state, "Manage server access in one place", with a short summary of what a scan will do.
Start the scan
Click Scan access
CtrlOps connects to each saved server and reads its authorized users. A progress panel shows each server as it's checked, the running count of "authorized users found", and which server is being read right now. Servers that aren't reachable are skipped.
Review the results
When the scan finishes, you land on the People list, everyone who can log in to one or more of your servers, with stats across the top.
Scanning is read-only. It looks at your servers but changes nothing until you explicitly remove or add access. The empty state says it plainly: "Read-only - nothing changes until you act."
Read the access list
The top of the screen has three stat cards, and below them is the searchable People list.
| Stat card | What it counts |
|---|---|
| People | Unique users found across all scanned servers |
| Servers | Servers included in the scan |
| Access grants | Total authorized key-to-server grants (one person on five servers is five grants) |
Each row in the People list shows:
| Row element | What it shows |
|---|---|
| Avatar and name | The person's name or username |
| Key type badge | SSH-ED25519 (secure) or SSH-RSA (standard) |
| Email / host | The key comment, e.g. hiren@macmini or an email address |
| Server chips | The first few servers this person can reach |
| Server count | Total servers, with a green shield count for how many grant sudo |
Use the Search people box to filter by name, and Re-scan (top right) to refresh the whole list.
See one person's access
Click any person in the list
A detail panel opens on the right. At the top it summarizes their reach, for example "19 servers · 19 with sudo". Below that, Active access lists every server they can log in to, each showing:
- The server name and a sudo badge when that grant has elevated rights.
- The exact login target, e.g.
root@35.157.41.17orubuntu@43.204.17.201. - A Remove button for that single grant.
At the bottom of the panel you can Grant access to more servers, Rotate SSH key, or Remove from all servers.
Remove a person from one server
When someone should keep most of their access but lose one server, you don't need to offboard them.
Open the person's detail panel → Find the server → Click Remove
CtrlOps revokes that person's authorized key for that one server. Their access to every other server is untouched.
Offboard a person from all servers
When a teammate leaves, remove them from everything in one step.
Open the person and start the removal
Open the person's detail panel → Click Remove from all servers
A confirmation dialog lists every server they'll lose access to.
Confirm by typing their name
The dialog asks you to type the person's name to confirm. This guard makes sure you're offboarding the right person and not removing access by accident.
Type the name → Click Remove from all servers
Done
CtrlOps revokes every authorized key and account for that person across all servers. You don't have to open a single server by hand.
Removing from all servers is a fleet-wide revoke and takes effect right away. Double-check you have the right person, and that you aren't removing the key you're currently using to connect, before you confirm.
If you only want to invalidate a person's existing key without removing their access, use Rotate SSH key in the detail panel instead. This is handy when a key may have been exposed.
Onboard a new user
When someone joins, give them access to many servers at once instead of editing each server's authorized_keys by hand.
Open the Add user form
Click Add user (top right)
A modal opens titled Add user, "Grant one person access to multiple servers at once."
Enter the name and public key
| Field | What to enter |
|---|---|
| Name | A friendly name, e.g. Jane Doe |
| SSH public key | Paste the user's public key, e.g. ssh-ed25519 AAAAC3... jane@laptop |
Select servers
Under Select servers, tick each server this person should reach. Use Select all to grab the whole fleet, and the counter ("3 selected") tracks your choices.
Set a role per server
For each selected server, set the TARGET login and role from the dropdown. You can mix roles across servers, root on one, a standard user on another.
| Role | Login | Rights |
|---|---|---|
| root | root | sudo (full admin) |
| ubuntu | ubuntu | standard user |
| readonly | readonly | read only |
Grant access
Click Grant access to servers
CtrlOps adds the public key to each selected server with the role you chose. The new person now appears in the People list.
Only paste the public half of a key pair (the part starting ssh-ed25519 or ssh-rsa). Never paste a private key.
Re-scan and export an audit
Access takes a snapshot when you scan; it doesn't watch your servers continuously.
- Re-scan (top right) rebuilds the People and server lists. Run it after you change keys directly on a server, add a new connection, or just want to confirm the current picture. The header shows when you Last scanned.
- Export Audit (top right) saves a snapshot of who can access what, useful for security reviews and compliance records.
Re-scan results and exported audits stay on your machine. CtrlOps never collects or transmits your access map.
Tips
Re-scan after anyone changes keys directly on a server (outside CtrlOps). Because Access stores a local snapshot, a manual change on the server won't show up until you scan again.
Offboard people from the Access screen rather than server by server. One confirmed Remove from all servers is faster and far less likely to leave a forgotten grant behind.
Use the readonly role when onboarding auditors or short-term contractors. They get in to look, without sudo.
Access is the fleet-wide view; the per-server SSH Management tab is still the place for one-off key work on a single server. Use them together.
Troubleshooting
SSH & Key Management
Manage authorized SSH keys on a connected Linux server with CtrlOps. Add, copy, and revoke keys from a visual registry, no terminal needed.
Infrastructure Details
Monitor Linux servers in real-time with CtrlOps. Live CPU, RAM, disk, and process stats in one dashboard; spot issues before they cause downtime.