Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need a cron job to transfer a file across servers using scp and kerberos authentication. The system user for the job is in /etc/passwd on both machines and a valid keytab has been created (with -randkey) for the kerberos auth. The cron job script calls kinit, then scp, then kdestroy. However, the scp won't work unless I change the /sbin/nologin in /etc/passwd to a valid shell, say /bin/bash.

Question #1: is this a security hole to specify a shell?
Question #2: is this the "right" way to do this?

Thanks in advance

share|improve this question
add comment

2 Answers

Answer 1: It may be. If you'd disable any other authentication method, and therefore forced use of the key and you believe this key to be strong, then a

Answer 2: With no valid shell scp will drop session before it transfers any files, which is a shame. It seems that scponly does what you want (http://www.sublimation.org/scponly/wiki/index.php/Main_Page).

share|improve this answer
add comment

question #1 usually isn't an issue, unless that user is root. There's also other layers you can use to limit access; iptables, tcpwrappers, the from= option in .ssh/authorized_keys, and pam_access to name a few.

Instead of using scp, which is a separate program and needs to be called with options from a shell, you could use sftp. On the server, set the service account's shell to sftp-server:

# RHEL systems
usermod -s /usr/libexec/openssh/sftp-server username
# debian systems
usermod -s /usr/lib/sftp-server username

Then call sftp in batch mode (-b batchfile) for non-interactive use.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.