测试/生产环境中应用SSH私钥文件的存储位置咨询（WinSCP .NET）

Great question—storing SSH private keys securely in test and production environments is critical to protecting your SFTP connections, especially when using the WinSCP .NET component. Let’s break down the best practices for where to store these keys and how to keep them safe:

Core Principles First #

Before diving into specific locations, remember two non-negotiables:

• Never hardcode the key path (you’re already using configs, which is perfect!)
• Never store keys in publicly accessible directories (like web roots, user home folders on shared servers, or unprotected program directories)

Recommended Storage Locations by Platform #

Windows Servers #

For Windows-based deployments (e.g., IIS-hosted apps, Windows services):

• Preferred Directory: Use a system-level hidden directory like C:\ProgramData\YourAppName\SftpKeys
  • ProgramData is designed for application-specific data that shouldn’t be visible to regular users, and it’s protected by default with admin-only permissions.
• Permissions Setup:
  1. Grant read-only access only to the service account running your application (e.g., IIS AppPool\YourAppPoolName for web apps, the Windows service account for background services).
  2. Remove all permissions for other users (including local admins if possible, unless they need to manage the key).

Linux Servers #

If your app runs on Linux:

• Preferred Directory: Use a dedicated app-specific directory like /var/lib/yourapp/sftp-keys or /etc/yourapp/sftp-keys
• Permissions Setup:
  1. Set file permissions to chmod 600 /path/to/your/key.ppk (only the owner can read/write, no access for others).
  2. Change the file’s owner to the user running your application: chown appuser:appgroup /path/to/your/key.ppk

Bonus: Enhanced Security Options #

For environments with strict security requirements, consider ditching file-based storage entirely:

• Cloud Key Management Services: Store the private key content in services like Azure Key Vault or AWS Secrets Manager. Then, retrieve the key content at runtime and use WinSCP’s SshPrivateKey property (instead of SshPrivateKeyPath) to pass the key directly to the SessionOptions.
• Encrypted File Storage:
  • On Windows, use EFS (Encrypted File System) to encrypt the key file itself—only the account that encrypted it (your app’s service account) can decrypt and read it.
  • On Linux, encrypt the key with GPG and decrypt it programmatically when your app starts (ensure the decryption passphrase is also stored securely, not hardcoded).

Example Workflow for Windows Production #

Let’s say you’re running an ASP.NET Core app in IIS:

1. Create the directory C:\ProgramData\MyRetailApp\SftpKeys
2. Copy your .ppk key into this directory
3. Right-click the key file → Properties → Security → Remove all inherited permissions, then add IIS AppPool\MyRetailAppPool with Read & execute access only
4. Update your app’s config (e.g., appsettings.Production.json):

   "SftpConfiguration": {
     "SshPrivateKeyPath": "C:\\ProgramData\\MyRetailApp\\SftpKeys\\Prod_SFTP_Key.ppk"
   }
   

The key here is to limit access to the key as much as possible while ensuring your application can still read it. Regularly audit permissions to make sure nothing has changed unexpectedly.

内容的提问来源于stack exchange，提问作者markpsmith