Piensa un momento en qué pasaría si mañana no pudieras entrar en una de tus máquinas. La clave SSH estaba en el portátil de alguien que ya no está. La contraseña de Administrator la cambió un técnico "temporalmente" y nadie la apuntó. Un cambio en la configuración de SSH salió mal y la puerta se cerró contigo fuera. La máquina sigue funcionando y la web sigue abierta, pero ya no mandas en ella, y en AWS no hay un "he olvidado la contraseña" ni un soporte que entre por ti.
Las salidas que quedan no son cómodas. En Linux, Lightsail te deja su consola web; en Windows, solo si nadie cambió nunca la contraseña. Cuando eso no sirve, toca parar la máquina, hacer una instantánea y levantar otra: horas de trabajo y de parada, en el peor momento, con la aplicación de un cliente dando servicio. Y si tampoco hay instantánea, se pierde todo lo que había dentro: no hay a quién llamar. La llave de repuesto de Simplio es exactamente lo que su nombre dice: una copia de la llave que dejas guardada antes de necesitarla. Se crea con un botón en la tarjeta de la máquina y, a partir de ahí, Simplio comprueba cada día que sigue abriendo. El día que te quedes fuera, desde esa misma tarjeta pones una contraseña nueva al administrador, le añades tu clave pública o lo desbloqueas. Con tu código del doble factor, en un minuto, sin parar nada.
How it works
You press "Create spare key" on the machine's card
En una máquina Linux, Simplio entra una sola vez con la clave temporal que da Lightsail y deja preparado el usuario
simplio-rescate. En Windows, Simplio te da un guion de PowerShell para pegar una vez por Escritorio remoto: activa el servidor OpenSSH que ya trae Windows, crea el usuario y abre el puerto 22 solo para la IP de Simplio. No se instala nada de Simplio en la máquina.The user is left without a usable password and only accepts five-minute certificates
simplio-rescateno tiene una contraseña que se pueda adivinar ni robar: en Linux no tiene ninguna; en Windows lleva una aleatoria de 40 caracteres que se genera, se aplica y se descarta en el mismo instante, sin guardarse ni mostrarse. La única forma de entrar es un certificado SSH firmado por Simplio, que caduca a los cinco minutos y que la máquina solo acepta si viene desde la IP del servidor de Simplio.Simplio checks every day that the key still opens
Una conexión de prueba diaria. Si alguien borra el usuario, cambia la configuración de SSH o cierra el puerto, lo ves en la tarjeta (la pastilla pasa a "Llave de repuesto perdida") y recibes un aviso, mientras todavía tienes acceso normal para rehacerla. Puedes comprobarlo a mano cuando quieras con "Comprobar ahora".
The day you get locked out: "Rescue with the spare key"
Escribes el usuario que quieres recuperar (bitnami, ubuntu, ec2-user, Administrator…) o, si no lo sabes, eliges "Ver qué usuarios hay en la máquina" y Simplio te los lista con su carpeta, si son administradores y cuándo entraron por última vez. Después eliges qué hacer:
- Ponerle una contraseña nueva. Simplio genera una, la aplica y te la muestra una sola vez. No se guarda en ningún sitio. En Linux puedes marcar que SSH admita además entrar con contraseña, porque muchas máquinas solo aceptan clave.
- Añadirle tu clave pública SSH. Pegas la pública de tu clave nueva y vuelves a entrar como siempre.
- Desbloquearlo. Para cuentas bloqueadas por intentos fallidos o caducadas.
- Consola como simplio-rescate. Para el técnico: una terminal con permisos de administrador, en el navegador, para arreglar lo que haga falta a mano. En Windows es una consola PowerShell, y es la que abre el botón Terminal de la tarjeta cuando Lightsail ya no puede dar la contraseña de administrador.
Todo pide el código del doble factor, también si eres administrador de Simplio, y todo queda en el registro de actividad: quién, qué, cuándo y desde qué IP.
If one day you don't want it, you remove it
"Quitar la llave de repuesto" borra el usuario, sus ficheros y las líneas de configuración que Simplio dejó. La máquina queda como antes.
How secure it is
No password to steal
The key's user has no usable password. Even if someone knows the name simplio-rescate, there is nothing to try: no brute force, no dictionary, no leaked password.
Certificates that expire on their own
Each sign-in uses an SSH certificate signed by Simplio that is valid for five minutes. There is nothing to revoke or clean up afterwards: after that time, it stops being valid by itself.
Only from Simplio's IP
The machine only accepts the certificate if the connection comes from the Simplio server. A copied certificate, or the signing authority itself, outside that server, is no use for getting in.
The signing authority, outside the database
The key Simplio uses to sign the certificates lives in the server's secrets file, outside the database and the backups, just like the master key that encrypts the rest of the secrets.
Simplio stores no key for your machine
Neither Lightsail's SSH key, nor the Administrator password, nor the new password it generates: that one is shown once and forgotten. The only thing left in Simplio is the fingerprint of the machine's SSH server, to check on every connection that it is talking to the right machine.
Two-factor always, and two different permissions
Creating the key and using it are separate permissions: you can let a technician create it on all machines without being able to use it, or the other way round. And every use requires the phone code, with no exceptions for administrators.
Everything in the activity log
Every creation, check, rescue and deletion of the key is logged with who, which machine, which action, when and from which IP. The new password isn't: it is never written to any log.
Coexists with what the machine already has
On Linux, the key relies on OpenSSH's standard mechanism (user certificates) without touching the global SSH configuration, so it coexists with the certificate authority Lightsail uses for its web console. On Windows it uses Microsoft's OpenSSH server that comes with the system itself.
The same task, in AWS and in Simplio
| On your own in AWS | In Simplio | |
|---|---|---|
| Getting the door ready | Create a certificate authority, a user, sudo, principals files and SSH directives on each machine, by hand; on Windows, install and configure OpenSSH | One button on Linux; on Windows, paste a script once |
| Storing the key | You, in a password manager, and remembering where | On the Simplio server, outside the database; the machine only accepts it from Simplio's IP |
| Know that it still works | Remember to test it now and then | Automatic daily check and an alert if it stops opening |
| Recovering access | Sign a certificate by hand, sign in over SSH, change the password or key with commands | Two-factor, choose user and action, and the new password on screen just once |
| Not knowing the user | Get in somehow and look at /home or the account list | "See which users are on the machine": list with folder, administrator and last sign-in |
| If there was no door | Linux: Lightsail web console. Windows: only if nobody changed the password; otherwise, snapshot and a new machine | Same: the key has to be set up beforehand. That's why Simplio warns you if a machine doesn't have one |
| If there is no snapshot either | Everything on the machine is lost | Snapshots scheduled every night, also in another region, with an alert if they fail |
Frequently asked questions
Can Simplio get into my machine whenever it wants?
Technically, the spare key is a door that Simplio opens. That's why it is built so that every use leaves a trace and requires a person: it takes a user from your account with permission to use it, their two-factor code at that moment, and everything goes into your activity log. Nobody at Simplio can use it without that, and you can remove it from any machine whenever you like.
Does it work if the machine already uses SSH certificates for something else?
Yes. On Linux the key doesn't touch the global SSH configuration: it relies on the authorized-keys file of the simplio-rescate user itself, so it coexists with Lightsail's certificate authority or any other. On Windows, if the OpenSSH server already had another authority configured, the script stops and tells you so you can review it by hand.
And on Windows, what is needed?
Windows Server 2019 and later include Microsoft's OpenSSH server as an optional feature (2025 comes with it already installed). The script enables it, creates the user with a random password that isn't stored, places Simplio's authority in the OpenSSH configuration and opens port 22 in the Windows firewall. In the Lightsail firewall you open 22 only for Simplio's IP. For you, Remote Desktop stays the same.
What happens if someone deletes the simplio-rescate user?
Anyone who is an administrator of the machine can do it; it's unavoidable. That's why Simplio checks every day: the card changes to "Spare key lost" and you receive an alert, so you can rebuild it while you still have access.
Is the new password that Simplio generates stored?
No. It is generated on the spot, applied on the machine and shown only once on screen. It doesn't go to the database, nor to the activity log, nor to any email. If you lose it, you ask for another.
Does it work for EC2?
Today the spare key is designed for Lightsail machines, where Simplio can get in the first time with the temporary key AWS provides. For EC2 the official AWS route is the AWSSupport-ResetAccess procedure of Systems Manager, which we explain in the guides.
Related guides
- Lightsail A spare key so you never get locked out of your machine
- Lightsail You have lost the Administrator password of a Windows machine in AWS: what you can do
- EC2 SSH certificates explained from scratch: log in without handing out keys
- Lightsail What to do if you have lost the SSH key to your machine
- Lightsail Open a terminal for your AWS machine from the browser, on Linux and Windows