Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I currently have a back-up script running via cron. It basically is a few rsync commands stringed together.

For my main shell logins I have ssh keys with passphrases, but because of the automated nature of the script, it uses a key without a passphrase. As I understand it, anyone that gets access to this passphrase-less key would have the same amount of access priviledges as myself logging in via my key with passphrase.

So should I create a new user, that only runs the script? If so, is it possible to restrict this user to only cron jobs or certain commands?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You can restrict what can be done with a specific SSH key, so if you can restrict the key to the bare minimum it should be fairly safe to use the same user. The safest option is to implement both options however ;-)

The sshd manpage has the details, but the following line in ~/.ssh/authorized_keys would only allow the specified command to be executed, and disallow other operations like port forwarding. It also restricts access to clients from a specific IP subnet.

command="/usr/local/bin/dobackup",from="1.2.3.0/24",no-pty,no-port-forwarding,no-agent-forwarding,no-X11-forwarding ssh-rsa AAAA...== alice@example.com
share|improve this answer
    
Thanks, that's great, exactly what I was looking for. It's a surprise that it isn't often mentioned in ssh key set-up guides especially for passphrase-less automated tasks. –  blndcat Jun 18 '12 at 6:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.