I need to send files from a group of servers to a remote server. My plan was to use rsync over SSH as it meets my requirement of a secure connection and the ability to delete from source upon successful transfer. I can also restrict the firewall to only allow IP's that I trust on port 22.

If I setup a cron job to transfer these files using rsync over SSH, I'm assuming I would need to setup SSH keys to communicate. However, what is the security risk of storing public keys on a bunch of servers? Is it better to create individual keys per server? This account will only be used to transfer files.

Editing to expand on my network.

I have multiple servers hosted by 3rd party hosting company that all have public IP's. My home network has a static IP and servers sit behind a NAT'd router. So I'm not sure how I can pull data on the central server from the devices behind the NAT.

I could create a central server behind the NAT that collects everything and open up a port forward out. With a firewall that restricts port 22 and the static IP of the database server, I guess that would handle any possible security breaches.

  • 1
    If you can do the opposite. Put all the keys on the cental one and defend it! It's more easy to maintain update one server that a bunch of clients. :) – Hastur Aug 11 '15 at 16:27
  • I was thinking this too as it would work for all servers with a public IP. However, I'm not sure how it would work inside the LAN in my house with one static IP. – linmod77x Aug 11 '15 at 16:34
  • 1
    There's negligible risk in storing public keys on a bunch of servers. They're public, and don't need to be kept secret. The risks are in storing private keys on servers, or using public keys to grant access to servers. – Mike Scott Aug 11 '15 at 16:39
  • Add the precise description of your network. Is the central server outside your network and all the clients with private ip behind a firewall? There's a way to access to the single client from the server (even via noip)? – Hastur Aug 11 '15 at 16:41
  • I modified my question to explain my network Hastur. – linmod77x Aug 11 '15 at 18:21
  1. Do the opposite if you can.
  2. Do a script on the central server with all the rsync actions, and run it from that server.
  3. You will keep all the access keys on it. You can set on all client /bin/nologin as a shell to decrease the risks again.
  4. If one of the client will fall, all the others will continue to work.

I will add that when using rsync over ssh it is always a good idea to restrict which command can be run with a corresponding key: even if the private key is stolen on the central server only this command can be run on the group of others servers.

You can do this with the "command=custom_script" option in the "authorized_keys" file.

Just use the "rrsync" script as the "restricting command" it does a perfect job. (/usr/share/doc/rsync/scripts/rrsync.gz on debian-like distrib)

More details here:

http://www.guyrutenberg.com/2014/01/14/restricting-ssh-access-to-rsync/

https://www.v13.gr/blog/?p=216

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.