6

Logging onto a machine over ssh typically requires a password to be entered before access is granted. Alternatively, a key/certificate (without a passphrase) can be installed onto the remote machine so that logging on no longer requires a password. This is particularly useful for automated or scripted solutions.

However, it is considered inadvisable and unsafe to create a key/certificate without a passphrase. Solutions involving ssh-add and ssh-agent are proposed as a means to enter a passphrase only once per session, but to still use a key/certificate with a passphrase.

What is the solution for automated connections between machines? How can a machine automatically update from a remote Bazaar repository (via bzr+ssh?) on a regular basis, as in a cron job? How can a machine automatically backup data from another machine (via rsync) as part of a cron job? rsyncd? This would not be encrypted though, which is a major disadvantage. I haven't looked at Bazaar daemon/server options.

1 Answer 1

5

For automated logins you have to use keyless ssh keys as you would have to manually intervene at the startup and provide a pass-phrase and have to resupply it after an restart.

To secure such keys there are multiple solutions - see man sshd for more details:

  1. Restrict the remote host for the key with the from= parameter, e.g:

    from="*.example.com" ssh_key
    

    this will only allow machines from example.com

  2. Specify which command will be executed with the command= parameter, e.g:

    command="some command" ssh_key
    
  3. Use a dedicated user with an restricted shell or only with the necessary permissions, e.g. for backup the user can only run rsync with sudo.

1
  • But where do I put from= and command=? I mean in which file? Nov 21, 2013 at 13:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .