We have a security solution that is deployed on premise to companies with big technical infrastructures. We do real time vulnerability/configuration assessment of all critical assets in the network.
The application server (referred to as "our server") has services that usually connect to other assets (like Linux Servers, Network Devices etc) through a Privileged Access Management (PAM) owned by the customer. Once the connection is made relevant data is pulled to our server for further processing and then inserted in the database.
We have some other set of customers who don't have a PAM and we store the private key in our database using AES-256. The respective AES keys are stored on the same server. We can't use something like PBKDF2 or bcrypt to store these passwords because they need to be used to make periodic connections to all assets.
Our server is hardened and continuously monitored by our VAPT team, hence the chances of it being compromised is very less. Worst case scenario, the server get's compromised then it becomes a door to the complete network infrastructure. Which is the primary apprehension of some of our prospective customers. Right now the answer and plan is to revoke key access and remove corresponding public keys from all assets.
Is there a way in which we can store the keys, reuse them and at the same time protect them from anyone (authorised/unauthorised) who has access to our server? We are evaluating some HSM's though we would prefer a solution that does not include extra hardware.
PS: We don't want manual intervention every time our application needs to connect to remote servers. (Inverse) All servers/assets connecting to this central node is also not preferable.
TL DR: How can FileZilla store credentials securely?