Logging onto a machine over ssh typically requires a password to be entered before access is granted. Alternatively, a key/certificate (without a passphrase) can be installed onto the remote machine so that logging on no longer requires a password. This is particularly useful for automated or scripted solutions.

However, it is considered inadvisable and unsafe to create a key/certificate without a passphrase. Solutions involving ssh-add and ssh-agent are proposed as a means to enter a passphrase only once per session, but to still use a key/certificate with a passphrase.

What is the solution for automated connections between machines? How can a machine automatically update from a remote Bazaar repository (via bzr+ssh?) on a regular basis, as in a cron job? How can a machine automatically backup data from another machine (via rsync) as part of a cron job? rsyncd? This would not be encrypted though, which is a major disadvantage. I haven't looked at Bazaar daemon/server options.


For automated logins you have to use keyless ssh keys as you would have to manually intervene at the startup and provide a pass-phrase and have to resupply it after an restart.

To secure such keys there are multiple solutions - see man sshd for more details:

  1. Restrict the remote host for the key with the from= parameter, e.g:

    from="*.example.com" ssh_key

    this will only allow machines from example.com

  2. Specify which command will be executed with the command= parameter, e.g:

    command="some command" ssh_key
  3. Use a dedicated user with an restricted shell or only with the necessary permissions, e.g. for backup the user can only run rsync with sudo.

  • But where do I put from= and command=? I mean in which file? – Hussain Tamboli Nov 21 '13 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.