If you only need to have the service working while you're logged in, make it connect to the
ssh-agent that you start with your session. The easiest way to do this is to use a fixed path for the agent socket. Set the
SSH_AUTH_SOCK environment variable to something like
/home/romeovs/.ssh/darkstar.agent.socket both in the systemd job and in your
.profile. Note that if your distribution starts an
ssh-agent process for you, you may need to kill it, or to leave it unused and replace it with your own. If the
SSH_AUTH_SOCK variable is present in the environment,
ssh-agent uses the path it contains for its socket. Then, when you log in, run
ssh-add on your private key, and the job will be able to use it.
If you need to have the job work all the time, I recommend creating a specific passwordless key for that purpose (
ssh-keygen -t rsa -f ~/.ssh/smd.id_rsa -N ''), and authorize it only to run a specific command on the server by using a
from= restrictions in the
~/.ssh/authorized_keys file on the server. The
from= option means that the key is only valid for login attempts from a specific hosts, and
command= specifies a command that is executed instead of the command specified by the client.
ssh-rsa AAAA…== romeovs@darkstar no-agent-forwarding no-port-forwarding no-x11-forwarding from="email@example.com" command="somecommand --foo"
The command is executed by your login shell. If you need to pass parameters to that command, you have two choices:
- The original command attempted by the client is in the
SSH_ORIGINAL_COMMAND environment variable. Beware of quoting issues if you attempt to parse it.
- A few environment variables are passed by the client. The exact set depends on the server configuration (
AcceptEnv directive in the