I've got a server that from time to time automatically updates a set of privileged files (eg, certificate keys, configs etc). It needs to save those files on other systems on the LAN. I know roughly how to do it, but I don't know the details of implementation.

The remote commands to receive and save the files (running on these other LAN servers) can be taken as static or very rarely changing, and can be hard-coded, meaning they're ideal for using with SSH Authorized Keys, but a lot of care is needed since the files they receive and store are still privileged and saved to paths otherwise only readable by root. The systems involved are all FreeBSD (+ one OpenBSD).

I visualise a process like this:

  1. Generate a key pair with ssh-keygen, suitable for local SSH (doesn't need to work with any public network or other systems or functions).
  2. Create a privileged account PRIV_USER on all systems, which has no access at all except via sshd (will need either su privileges generally, which should be safe for a fixed script, or at minimum write access to specific hard-coded locations ordinarily readable/writable by root only, because it needs to save the received files).
  3. Set up an Authorized Keys section in sshd on all other systems, which, when connected as PRIV_USER, automatically receives a tar'ed archive of files and untar's them onto the local file system, then disconnects.
  4. On the sending system, when files need to be updated remotely, run a short script that that creates a tar archive of the files to be sent, and then connects to the remote system(s) in turn as PRIV_USER, sends the files over SSH, notes success/failure to console, and exits.

I'd like to avoid blowing security by getting these wrong, and I haven't used Authorized Keys for this purpose before, nor had to generate my own internal key pairs for a purpose like this, nor created limited privileged accounts. So there's a lot of ways I could get it subtly wrong.

What are the correct commands I should use for a minimal basic "not screwed up" implementation of this function? :)

  • 1
    SSH does not use SSL. SSH keys don’t expire. They don’t have a CA. – Daniel B Jul 12 '18 at 11:24
  • Thanks - I've edited a bit. If more needs fixing, let me know and I'll edit the Q to correct it. – Stilez Jul 12 '18 at 11:29
  • Well, like I said: No SSL involved. As such, no OpenSSL/LibreSSL, no chain of trust or whatever. There are no CAs involved at all. Just ssh-keygen. – Daniel B Jul 12 '18 at 11:42
  • Thanks - I've edited and removed references to OpenSSL/LibreSSL. – Stilez Jul 12 '18 at 12:22
  1. ssh-keygen to create local key
  2. create new server(s)
  3. ssh-copy-id to root@newserver
  4. create ansible playbook repository of desired configuration (including sshd password only)
  5. run ansible-playbook

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.