Is it acceptable to share private SSH keys across servers for read-only access to a Git repository?

Question

I'm working on a project currently stored in a private Git repository on Bitbucket, that will be deployed to multiple external servers.

Because the repo is private, I need these servers to be able to authenticate to clone the repository as well as pull when there are updates. For this, it looks like access keys are the way to go.

My question is - is it acceptable to generate one SSH key and copy the private key onto each server that needs to clone the Git repository? The public key would be added to Bitbucket the first time, so every server that had the private key would be able to access the Bitbucket repo.

My rationale is just convenience - the provisioning process for these servers is going to be largely automated, and it would help a great deal if I could copy an existing private key as part of the process, and then immediately get going by cloning the repository. If I have to create a private key per-server, it means manually logging in to my Bitbucket account to add each key.

I understand that in general, the answer to "should you share private keys" is a solid "no", but I couldn't find much information relating to this particular use case. The keys would only be used for access to this one repo. I don't need to identify which server is accessing what on the repo, because all of the servers will largely be completing the same actions.

Answer 1

If your only use-cases are cloning and pulling, the ideal way to share a bitbucket repository is indeed with an access key, previously called a deployment key.

These keys give read-only access to the repository, so an attacker who infiltrates any one of your servers do not get push access to your repository (which could have severe effects), they do however obviously get access to your code, and a key to clone and pull the repository.

It's better practice to use separate access keys per server since sharing the access key would mean switching the access key on all the servers if one server gets infiltrated. In contrast, using one access key per server means if one server gets infiltrated, disabling that one access key removes access to your repository from the possible attacker.