Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Logging onto a machine over ssh typically requires a password to be entered before access is granted. Alternatively, a key/certificate (without a passphrase) can be installed onto the remote machine so that logging on no longer requires a password. This is particularly useful for automated or scripted solutions.

However, it is considered inadvisable and unsafe to create a key/certificate without a passphrase. Solutions involving ssh-add and ssh-agent are proposed as a means to enter a passphrase only once per session, but to still use a key/certificate with a passphrase.

What is the solution for automated connections between machines? How can a machine automatically update from a remote Bazaar repository (via bzr+ssh?) on a regular basis, as in a cron job? How can a machine automatically backup data from another machine (via rsync) as part of a cron job? rsyncd? This would not be encrypted though, which is a major disadvantage. I haven't looked at Bazaar daemon/server options.

share|improve this question
add comment

1 Answer 1

up vote 5 down vote accepted

For automated logins you have to use keyless ssh keys as you would have to manually intervene at the startup and provide a pass-phrase and have to resupply it after an restart.

To secure such keys there are multiple solutions - see man sshd for more details:

  1. Restrict the remote host for the key with the from= parameter, e.g:

    from="*.example.com" ssh_key
    

    this will only allow machines from example.com

  2. Specify which command will be executed with the command= parameter, e.g:

    command="some command" ssh_key
    
  3. Use a dedicated user with an restricted shell or only with the necessary permissions, e.g. for backup the user can only run rsync with sudo.

share|improve this answer
    
But where do I put from= and command=? I mean in which file? –  Hussain Tamboli Nov 21 '13 at 13:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.