0

I have looked previously asked question on this topic but found no matches what I am looking for.

Scenario:

There are two centos systems, let's say, System1 and System2.

A script in System1 uses a non-login shell user(user1) to download file from web and places it at the user's home directory(/home/user1).

Another script in System2 uses a non-login shell user(user2) to scp file from system1 and do some operation.

These users are created while installing the script in both systems using root user.

below is the snippet of the spec file which is creating user1 and user2.

getent group user1>/dev/null || groupadd -r user1
getent passwd user1>/dev/null || \
    useradd -r -g blacklist -m -s /sbin/nologin \
    -c "the user is created as it downaloads the conent from web" user1
exit 0

challenge: the conventional way to do passwordless scp is to create a pair of keys and copy public keys in the remote systems. But how can i generate the user-specific key and copy to it the remote server if I cannot login?

please advise me a good approach to handle this requirement.

5
  • Is it CentOS 8? If so, you may create the users by declaring them in sysusers.d (5) files. May 26, 2020 at 15:08
  • I didn't understand whether you were creating users on System1 and Systems2 from a third control workstation or you were doing local logons on them. How are the user creation scripts being triggered? May 26, 2020 at 15:13
  • I am creating rpm package and installing the script in both system sperately as root user.
    – Monu
    May 26, 2020 at 15:14
  • I have another question... Would the file transfer from System1 to System2 require a secure communication method such as SCP/SSH? Or, on the other side, would a file transfer made in clear over the network be an acceptable option? May 26, 2020 at 16:39
  • only SCP is allowed . And please note that these user are non login user..
    – Monu
    May 26, 2020 at 16:41

1 Answer 1

0

As copy using SCP protocol is a functional requirement for your RPM packages and SCP does require underlying SSH authentication, I could only imagine the following options:

  • Hardcode SSH keypairs inside RPM packages being generated. Those keys could either be generated by calling ssh-keygen inside the %build section or be generated in advance and imported as source files. Afterwards, they could be properly installed as ~/.ssh/id_rsa and ~/.ssh/authorized_keys.

  • Hardcode the password of the user inside the RPM packages and use sshpass to perform non-interactive authentication from System2.

  • Have user2 authenticated to System1 via host-based authentication. You could invoke substitution commands inside the %post section to enable host-based authentication and configure ~/.ssh/known_hosts and ~/.shosts file accordingly.

Each alternative has benefits and security implications and the most acceptable one depends on your environment policies. I could not elect the best answer.

Somehow, you will need to automate the authentication configuration from user2@System2 to System1 or, alternatively, create a post-install message requesting the person installing the package to do so. In fact, I don't imagine any alternative to have System2 authenticating an identity from System1 that does not involve generating and copying an unique authentication datum known to both systems.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .