up vote 2 down vote favorite
share [g+] share [fb]

Our company has a server that is a locked down version of Linux (custom shell for users, no direct access). I am currently pushing updates to the user, but it would be more ideal for the users to do a pull.

Each device has a serial number that would probably be used as part of the login to an update server.

I would like to have multiple channels/branches (whatever they should be called), such as MAIN and DEV.

What protocol would be best for this situation? FTP is easier to limit directory access, in case someone was to get the full login information. SCP would be better, as I would like to secure the transmission, but I would prefer read-only and limited to a directory. Can this be done with SCP?

What should the username/password be? I guess for SCP, the serial number could be the username, and instead of a password, generate a key for the user.

link|improve this question
80% accept rate
feedback

2 Answers

up vote 3 down vote accepted

Don't use a username/password scheme.

Use SSH keys. This gives you the following advantages:

  • can use SCP (or rsync for more control!)
  • can use one account for all logins, differentiated only by the key used to log in
  • can easily revoke a key by removing it from authorized_keys
link|improve this answer
that works, except you can't change switch a device from the "production" to "development" branch server-side. Of course, that might be a good thing ;) +1 – Michael Lowman Aug 11 '11 at 14:13
^ requirement not specified in question :p. And yes you could by changing the path give in the allowed command in authorized_keys. – MikeyB Aug 11 '11 at 14:14
true enough, didn't think of it. good solution. – Michael Lowman Aug 11 '11 at 14:19
I did mentioned keys in the last paragraph. I do like rsync, but not sure if it would be necessary in this case. – bradlis7 Aug 11 '11 at 15:13
1  
Other advantages to using SSH keys is that you can associate each key with a serial number (using a forced command) without the user being able to touch it. The customer could still have control over which branch of the codebase they get by altering how they call into the server (look at SSH_ORIGINAL_COMMAND in the manpages) – womble Aug 11 '11 at 18:18
feedback
up vote 1 down vote

With SCP/SFTP each user is able to download exactly what they can see. So if the user account is only given read permissions in their homedir, which has a symlink to whichever branch they should be viewing, that's what they'll see and what they'll be able to get.

Test by logging in as one of the users and trying to less the files you want to be secure. If your permissions are properly set you won't be able to.

The username/password could certainly be what you propose. Remember to have some way to update the key on the device if compromised, though.

link|improve this answer
I understand permissions in Linux. The Linux machines that I have used default to read ability to 95% of files, so I would have to have a dedicated server (a virtual server could work). – bradlis7 Aug 11 '11 at 14:42
@bradlis7 well, you could... or you could run sshd in a chroot, I suppose. It'd be easiest just to lock down your permissions properly though. – Michael Lowman Aug 11 '11 at 14:45
Good point. I think I will either do a chroot or a dedicated server. – bradlis7 Aug 11 '11 at 15:10
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.