0

I have a set of files on a remote sftp which I need to download to a server every day. sftp uses ssh keys to authenticate, so I created a ssh key and added to the remote server authorized folder. I'm able to ssh/sftp successfully manually. I h've creatd a script which first does a eval ssh-agent -s and then ssh-add. When run manually, we get a prompt for passphrase and scp works fine.

eval `ssh-agent -s`;
ssh-add;
#copy from remote to local

I need advice/best practice on how I can avoid keying in passphrase when I add this crontab to run everyday.

  • Does the key you are trying to use have a passphrase? You can avoid using ssh-agent/ssh-add by using the -i option on sftp. – Arcege May 21 '15 at 0:25
1

I need advice/best practice on how I can avoid keying in passphrase when I add this crontab to run everyday.

Create a new ssh key with an empty password, specially for this task. Save it in a file, say, ~/.ssh/cron. Add its corresponding public key to ~/.ssh/authorized_keys on the remote machine. When you run your scp from cron(8) do it with the new key:

scp -i ~/.ssh/cron ...

That's all there is to it, you don't need ssh-add.

eval `ssh-agent -s`

Contrary to the popular belief, this is bad practice. ssh-agent doesn't get killed when you exit the terminal, and it stays with you for ever and ever, useless but fully authenticated, happily ever after. You won't be able to connect to it, but it will always be there for some nifty trojan to discover and use. You'll also accumulate many copies over time.

Do it like this instead:

ssh-agent /bin/bash -l

This spawns a shell, and exits when you quit said shell. Don't try to script it, use it only for interactive sessions, and kill it as soon as you're done.

  • "Create a new ssh key with an empty password..." The OP could just remove the passphrase from the key file that he already has. ssh-keygen has an option to change the passphrase for an existing key file. – Kenster May 22 '15 at 18:43
  • @Kenster: Probably not a good idea, for security reasons. There really should be a dedicated key for unattended jobs, separate from the usual key for interactive logins, and the key should be restricted on the server in authorized_keys. In fact, the unattended jobs should be run from an unprivileged, nologin account, not from an actively used one. – lcd047 May 22 '15 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.