I'm learning about security at the moment, and I want to store my clients' public keys on the server to facilitate distributing and managing those keys, my question is what are the possible ways to protect those keys when they are stored in the server from manipulating by attackers?
It depends on a number of issues such as how they are used, what the architecture of the server is, etc. But a few ideas to think about are:
can you store them on a 'write only' medium? A 'finalised' CD-ROM for example?
can you check their fingerprints before use against a copy of the fingerprints stored on a different server, or downloaded from a (trusted) public key server?
can you download the keys from a (trusted) public key server before each use (check the security of the connection to the key server, including DNS records resolving to the server before use)?
can you enter the fingerprint for the keys ephemerally at boot time and then compare them against the computed fingerprint at the time of use?
have you got file integrity software running that you can trust? If not, I'd consider this option very strongly because you may be able to trust the keys, but if the rest of the system is compromised why is that any use?
PKI is a 'solved problem' to some extent so have you also looked at commercial solutions to this everyday problem?