1

I need a cron job to transfer a file across servers using scp and kerberos authentication. The system user for the job is in /etc/passwd on both machines and a valid keytab has been created (with -randkey) for the kerberos auth. The cron job script calls kinit, then scp, then kdestroy. However, the scp won't work unless I change the /sbin/nologin in /etc/passwd to a valid shell, say /bin/bash.

Question #1: is this a security hole to specify a shell?
Question #2: is this the "right" way to do this?

Thanks in advance

2 Answers 2

1

Answer 1: It may be. If you'd disable any other authentication method, and therefore forced use of the key and you believe this key to be strong, then a

Answer 2: With no valid shell scp will drop session before it transfers any files, which is a shame. It seems that scponly does what you want (http://www.sublimation.org/scponly/wiki/index.php/Main_Page).

1

question #1 usually isn't an issue, unless that user is root. There's also other layers you can use to limit access; iptables, tcpwrappers, the from= option in .ssh/authorized_keys, and pam_access to name a few.

Instead of using scp, which is a separate program and needs to be called with options from a shell, you could use sftp. On the server, set the service account's shell to sftp-server:

# RHEL systems
usermod -s /usr/libexec/openssh/sftp-server username
# debian systems
usermod -s /usr/lib/sftp-server username

Then call sftp in batch mode (-b batchfile) for non-interactive use.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .