1

I am connecting my computer located at my home to a remote server.

To communicate with the server, I use a config file that contains my private and public keys and a passphrase. My code reads the config file and sends a message containing the signature from the private key, the public key and the passphrase.

Now, I would like to run my code on the Cloud, for example AWS. I suppose it is not safe to store the config file on AWS, so what would be the correct way to connect safely from AWS to the remote server ?

1

The solution I use in the case of secrets (not only for your case, but also to make sure that I do not commit them with the code) is to put them in an environment variable when starting my code

$ API=kjsdhtgsdsdskdjsldjsldjklskjd /usr/bin/python3 mycode.py

It is not absolutely secure as the key is still in memory. It is also a pain to start the command with the secrets like this.

I usually end up adding the keys to the systemd service file I start my code with. It is in a file, but at least not together with the code.

Finally you can prompt for the keys at startup, which is not practical is the code is supposed to run headless.

The enterprise solution is a HSM, which is a glorified service to retrieve your keys from, based on some criteria.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.