This is not really a programming question, but please hear me out. I am building a deployment tool, So using my application others can deploy their own application to their own servers. (just like forge.laravel.com),
Following are the use cases for this particular question
- I need to store each of my user's public ssh keys because I need to insert this key in each of the provisioned servers. so that users can log into their servers via ssh without any manual authorizations.
- Also, I need to authorize my applications ssh key (ie: my servers public key) into customers servers so that I can execute commands on my user's server on their behalf.
- I need to generate a new key on the newly provisioned customer server and authorize it in github/gitlab of the customer so that when I push/pull from the server I don't need to enter any username or password.
Coming to the question, Where/how do I store these keys (securely)? can I store them in a specific directory in my server? This makes me think that my server can be a big target for hackers since if they are able to hack, it opens doors to a multitude of servers.
What are the steps I can take to make this setup more secure?
Considering use case 2, does it make any difference if I generate separate keys for separate customers?