I have a bunch of servers that need to access somewhat sensitive data (passwords for ftps, api keys, etc). Currently I copy a plaintext file back-and-forth between the servers via ssh and encrypt all the keys based on the server's private ssh key, but I'm looking for a more robust solution that a) other people can do and b) doesn't require as much manual work. What I'm thinking, and would like feedback on:
- Create a shared private key, protected with a strong passphrase
- Encrypt all necessary passwords with this key, store those keys in a config file
- When a new server is brought up, copy the ssh key, remove the passphrase
Any issues with this? The passphrase-encrypted private key will be "publicly" accessible, that is to everyone in the company.