Re: Scripted SSH Key generation for users. (Script is as root)

From: John (jr2_at_dataconnection.com)
Date: 07/11/03 

Date: 11 Jul 2003 00:49:19 -0700

Richard E Silverman <res@qoxp.net> wrote in message news:<m2el0y5kws.fsf@darwin.oankali.net>...
> >>>>> "J" == John <jr2@dataconnection.com> writes:
>
> J> I am trying to develop a system whereby a user has their
> J> public/private keypair generated at boottime. Unfortunatly keys
> J> generated by my scripts are only valid for root,
>
> What do you mean by this? Keys are not "valid for" a user in any
> intrinsic way.

A user can not logon as that user using a key generated as root. I
can only log in as root with a key generated as root.
Unless I am missing something obvious...

>
> J> Is there a way to create these keys FOR the user, from a script run
> J> as root?
>
> Why would you want to do this? Keys should be generated by the user so
> they can be written to disk using his passphrase. What passphrases will
> you use and how will you communicate them to the user? He will have to
> run ssh-keygen again anyway to change the passphrase, at which point he
> may as well have simply generated the key himself.
>
> J> Both halves of the key are only used locally.
>
> What does this mean? Why would you only need to SSH back into the same
> host?

The user is a dummy user, to allow limited access outside of a chroot
jail.

When a real user uses SFTP / SCP they are contained in a chroot jail.
There is no way to allow them out of this jail if they log in
interactively (the design of OpenSSH precludes it).

The system I am working on has a set of (assumed secure) scripts,
which require access to the root filesystem, for these users. The
attempt is therefore to silently ssh back into the box, but outside
the chroot jail.

For security reasons I would like the keys used for this to be
generated at boottime (no passphrases as the ressh'ing must be
silent).

Many thanks,

John

Relevant Pages

  • SUMMARY and apology Re: Some bash/tty questions
    ... Some people tend to create complex login scripts ... If you don't allow direct login to root, but rather su to root, then so ... Hi, not to bash down on bash, but perhaps you should try zsh, it has the shared history thing built in. ...
    (SunManagers)
  • RE: suEXEC
    ... Change your web scripts to create a file of usernames to create, for example, /var/tmp/users. ... The file should be owned by root, group apache, with permissions 660. ... first virtual hosting is showing username cgiuser but second virtual ...
    (RedHat)
  • Re: user permission problems
    ... Subject: user permission problems ... Note you should put any commands in a shell script so asroot can execute it with root perms, and you can add sanity tests to prevent things like ... add root and the special scripts like "kill_it' to the users that will use the scripts. ... I would assume the symlink is done from another restricted dir, such as a support dir owned by the support login, and only RW perms for the owner. ...
    (comp.unix.sco.misc)
  • Re: awstats munged httpd rights in SElinux, how to fix?
    ... terminal as root for configuration issues. ... your computer up to the world as a webserver. ... I don't have the scripts ... (i.e. encrypted access only). ...
    (Fedora)
  • Re: Linux hardening
    ... I believe the root for the intrusion is very likely the web ... specific vulnerable scripts. ... >> nice check that can assist you in finding some of the more common and ... > I have chkrootkit but did not know about rootkit hunter. ...
    (Focus-Linux)