I want to setup SSH keys to automate
scp jobs. My current assumption is that "automate" implies SSH keys without a password, but I am open to your suggestions.
I did a lot of Googling before I asked this question. Here is what I found:
- Lots of pages explain how to configure SSH keys without a password
- Very few pages explaining the security implications of SSH keys without a password
Thus, this question is a prime candidate for what Jeff Atwood calls "Making the Internet a Better Place".
For the purpose of this question, imagine this config:
- Source 1 (not controlled by me):
- Source 2 (not controlled by me):
- Source X/Y/Z (not controlled by me): etc.
- Destination (controlled by me):
- Goal: Setup "jobs" (scripts, whatever) to copy files from
I already know about:
ssh-keygento generate SSH keys
- SSH keys can have empty/no password
~/.ssh/id_dsahas the private key
~/.ssh/id_dsa.pubhas the public key
~/.ssh/authorized_keysand carefully set its file permissions
- Share contents of
~/.ssh/id_dsa.pubwith other user/host to use with
In my own testing between different hosts/users, I know my setup works.
What troubles me are the security implications. And, I confess that I am not a Linux admin, nor a security expert.
- If I give this public SSH key to another division to use with
scp, what if that same key is leaked/lost/stolen to another division?
- Does this imply anyone with access to this public SSH key can use
user3without a password?
Important assumptions to consider for your responses:
- I do not care about external hackers via the wider Internet. These are Linux boxes on a secure corp network.
- I cannot setup additional user IDs.
I am guessing there is a way to restrict access for a specific SSH key, but I don't know how. Maybe
~/.ssh/authorized_keys options (which I just learned about today)? Is it possible to have multiple SSH keys -- give a different key to each source?
Please advise The Right Way.