Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have a back-up script running via cron. It basically is a few rsync commands stringed together.

For my main shell logins I have ssh keys with passphrases, but because of the automated nature of the script, it uses a key without a passphrase. As I understand it, anyone that gets access to this passphrase-less key would have the same amount of access priviledges as myself logging in via my key with passphrase.

So should I create a new user, that only runs the script? If so, is it possible to restrict this user to only cron jobs or certain commands?

share|improve this question
up vote 1 down vote accepted

You can restrict what can be done with a specific SSH key, so if you can restrict the key to the bare minimum it should be fairly safe to use the same user. The safest option is to implement both options however ;-)

The sshd manpage has the details, but the following line in ~/.ssh/authorized_keys would only allow the specified command to be executed, and disallow other operations like port forwarding. It also restricts access to clients from a specific IP subnet.

command="/usr/local/bin/dobackup",from="",no-pty,no-port-forwarding,no-agent-forwarding,no-X11-forwarding ssh-rsa AAAA...==
share|improve this answer
Thanks, that's great, exactly what I was looking for. It's a surprise that it isn't often mentioned in ssh key set-up guides especially for passphrase-less automated tasks. – blndcat Jun 18 '12 at 6:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .