Re: Piping and scripts with scp

From: Karsten W. Rohrbach (karsten@rohrbach.de)
Date: 07/19/01 

Date: Thu, 19 Jul 2001 16:41:33 +0200
From: "Karsten W. Rohrbach" <karsten@rohrbach.de>
To: Brett Glass <brett@lariat.org>

generate ssh keys with ssh-keygen(1) and limit the remote command to
something that makes sense.
generate one key pair for every command you want to run and name the key
files appropriately to reference the in you ssh(1) invocation.

a command restricted pubkey looks like this (example for self-contained
scp to a defined subdirectory):
command="scp -t /path/to/data",from="1.2.3.4" <keydata comes here...>

this pubkey will be placed in the corresponding
$HOME/.ssh/authorized_keys file on the target host.

if you invoke scp with the corresponding key, scp's remote invocation is
limited to the target directory /path/to/data and to the source host ip
1.2.3.4.

have fun
/k

Brett Glass(brett@lariat.org)@2001.07.18 13:59:54 +0000:
> I need to create a script that deposits the output of a program in a file on a
> remote host. I'd like to do this over an encrypted connection, so I'd like to
> use scp for this purpose. The script will need to execute via cron and run
> unattended, and I'm limited to the SSH-1 protocol for the moment (though I
> intend to move to SSH-2 when all the hosts can handle it).
>
> Trouble is, I cannot seem to find options for scp that will allow me
> to (a) pipe data into it for placement in the remote file; or
> (b) supply a password -- kept only in the script, which cannot be
> read except by root -- in advance rather than manually at the console.
> (Yes, I could generate and use RSA keys, but since anyone who could
> view the script will have broken root, he or she could also get at
> the private key anyway... so there's no additional security in this.)
> Help from someone experienced with scp and ssh would be appreciated.
>
> --Brett Glass
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message 

-- 
> Microsoft isn't the answer. Microsoft is the question, and the answer is no.
KR433/KR11-RIPE -- WebMonster Community Founder -- nGENn GmbH Senior Techie
http://www.webmonster.de/ -- ftp://ftp.webmonster.de/ -- http://www.ngenn.net/
karsten&rohrbach.de -- alpha&ngenn.net -- alpha&scene.org -- catch@spam.de
GnuPG 0x2964BF46 2001-03-15 42F9 9FFF 50D4 2F38 DBEE  DF22 3340 4F4E 2964 BF46
Please do not remove my address from To: and Cc: fields in mailing lists. 10x

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: scp. I dont get it
    ... allows you restrict the use of the key to a specific ip, ... only use scp, and even then, only if the destination includes ... or running a cron script to do it for you. ... # original scp command given by the client. ...
    (comp.os.linux.security)
  • Re: Apache timeout on external command
    ... command-line application on a remote server. ... The Perl script connects ... seconds to about two minutes to complete the command. ... remote command still running to completion after apache has apparently ...
    (comp.infosystems.www.servers.unix)
  • Re: wshremote not running script on remote computer
    ... "The script you deploy to the remote computer must not attempt to interact ... I do want to open a command window on a remote machine, ...
    (microsoft.public.scripting.vbscript)
  • RE: SCP help
    ... > I have developed a CGI that will take information from a CGI based ... > SCP a specific file to a remote server. ... > If I do the above command from the command line all works perfectly. ... Is the script setuid? ...
    (perl.beginners)
  • Apache timeout on external command
    ... We have a Solaris 9 server running apache 2.0.53. ... command-line application on a remote server. ... The Perl script connects ... seconds to about two minutes to complete the command. ...
    (comp.infosystems.www.servers.unix)
Loading