I currently have a back-up script running via cron. It basically is a few rsync commands stringed together.

For my main shell logins I have ssh keys with passphrases, but because of the automated nature of the script, it uses a key without a passphrase. As I understand it, anyone that gets access to this passphrase-less key would have the same amount of access priviledges as myself logging in via my key with passphrase.

So should I create a new user, that only runs the script? If so, is it possible to restrict this user to only cron jobs or certain commands?


You can restrict what can be done with a specific SSH key, so if you can restrict the key to the bare minimum it should be fairly safe to use the same user. The safest option is to implement both options however ;-)

The sshd manpage has the details, but the following line in ~/.ssh/authorized_keys would only allow the specified command to be executed, and disallow other operations like port forwarding. It also restricts access to clients from a specific IP subnet.

command="/usr/local/bin/dobackup",from="",no-pty,no-port-forwarding,no-agent-forwarding,no-X11-forwarding ssh-rsa AAAA...== alice@example.com
  • Thanks, that's great, exactly what I was looking for. It's a surprise that it isn't often mentioned in ssh key set-up guides especially for passphrase-less automated tasks. – blndcat Jun 18 '12 at 6:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.