I've got a server that from time to time automatically updates a set of privileged files (eg, certificate keys, configs etc). It needs to save those files on other systems on the LAN. I know roughly how to do it, but I don't know the details of implementation.
The remote commands to receive and save the files (running on these other LAN servers) can be taken as static or very rarely changing, and can be hard-coded, meaning they're ideal for using with SSH Authorized Keys, but a lot of care is needed since the files they receive and store are still privileged and saved to paths otherwise only readable by root. The systems involved are all FreeBSD (+ one OpenBSD).
I visualise a process like this:
- Generate a key pair with
ssh-keygen, suitable for local SSH (doesn't need to work with any public network or other systems or functions).
- Create a privileged account
PRIV_USERon all systems, which has no access at all except via sshd (will need either su privileges generally, which should be safe for a fixed script, or at minimum write access to specific hard-coded locations ordinarily readable/writable by root only, because it needs to save the received files).
- Set up an Authorized Keys section in sshd on all other systems, which, when connected as
PRIV_USER, automatically receives a tar'ed archive of files and untar's them onto the local file system, then disconnects.
- On the sending system, when files need to be updated remotely, run a short script that that creates a tar archive of the files to be sent, and then connects to the remote system(s) in turn as
PRIV_USER, sends the files over SSH, notes success/failure to console, and exits.
I'd like to avoid blowing security by getting these wrong, and I haven't used Authorized Keys for this purpose before, nor had to generate my own internal key pairs for a purpose like this, nor created limited privileged accounts. So there's a lot of ways I could get it subtly wrong.
What are the correct commands I should use for a minimal basic "not screwed up" implementation of this function? :)