How to encrypt and securely store and transmit private keys of SSH

user_2693543 0
Viewed 339

I have to generate ssh key pairs for multiple server instances, and keep the private keys in the same/other server for further automation tasks.

What are some ways to protect these keys in case of a hacking attempt?

Does AWS Key Management Service can help to secure these key files, one possible solution I am thinking is to

  1. Keep the private keys encrypted with AWS KMS and Keep the keep the key in database with the AWS key ID.

And then I will transmit the encrypted private key related to the automation server and then the decryption of Key happens in the automation server which calls aws for decryption and then use the plaintext ssh private key to authenticate with the instance.

Is this a viable approach? I feel like this is just an added layer of security rather than a solid solution. What are some approaches would help here?

amazon-web-services encryption
2 Answers

Yes you can encrypt these keys with KMS, when you encrypt the content you will receive both a plain text and encrypted copy of the data encryption key (both are Base64 encoded).

When you store the object in the data store you would need to save it with the encrypted data encryption key. Then when you need to retrieve this key you would decrypt it using the CMK.

user_134609330

I suggest looking into AWS Secrets Manager for this. Secrets Manager will allow you store the SSH keys in an encrypted form, using the KMS key of your choice, and control access to each SSH key using IAM policies.

user_130700
Related