setting up a password for cron rsync over ssh

Question

I'm writing a bash script that will be called from cron to pull a file from a remote server once a day. I'm using SSH, so I need to supply a password automatically since this is running unattended. Here's what I've come up with so far:

1: create a DSA key pair via ssh-keygen
2: copy the public key to the remote server
3: configure ssh-agent to deal with the key passphrase

My question is: Is all this necessary? Is this the simplest/best approach? This is a really simple task, so I'd like to make the configuration as simple as possible while maintaining a reasonable level of security.

Additional info:
-not running the rsync daemon
-both machines are Ubuntu linux

Answer 1

Anything you do will be insecure without the use of ssh and sshd.

The canonical way is to use scp or even better, rsync and an ssh key without a password.

Alternatively, create a key used only for copy, and on the remote end edit the authorized_keys file to contain only the command(s) you need to run, and the key, e.g.:

# remote_server:/home/copyuser/.ssh/authorized_keys:
command="[...]" ssh-rsa KEY_HERE user@host

There is also scponly available. If you create a user, set their shell in /etc/passwd to /usr/bin/scponly and they will not be allowed to login, but copy files in and out per the normal permissions.

Answer 2

While I suppose you could use a passphrase-protected private key, that's usually not recommended for processes that are intended to run via cron. I'd recommend skipping the passphrase and then making sure that whatever user account you're using only has very limited privileges on the target box. By skipping the passphrase, you won't need to deal with messing around with ssh-agent.

Answer 3

Here are my recommendations:

• Create a specific set of SSH public/private keys for this cron job. Use: ssh-keygen -t rsa -N '' -f id_cronjobname
• Protect the resulting id_cronjobname file such that only the cron job can read it. If this file is compromised, anyone with that keyfile can potentially gain the same privileges.
• Restrict the use of that key on the remote end. For example, in the remote authorized_keys, you may wish to prefix the key with the example below.
• Consider also using "from" to limit the IP address in the authorized_keys file. See "man sshd" for more information on these restrictions.

Example line from remote authorized_keys file:

no-pty,no-agent-forwarding,no-X11-forwarding,no-port-forwarding,command="rsync --server --sender -vlogDtprze.i --ignore-errors --numeric-ids --inplace . /path/on/destination/system" ssh-rsa SSH_KEY_STRING user@host"

The exact command to put in there you can get by running the rsync command you plan to use, and then at the same time on the remote system do "ps awwlx | grep rsync".

NOTE: One common problem I run into is that the use running the cron job does not have the remote host's SSH key, so it is trying to ask if the connection is ok. Make sure you place the remote system's SSH host key in /etc/ssh/ssh_known_hosts (probably just copy it out of your own ~/.ssh/known_hosts file after you have connected). Alternately, you can do "su - $USER_CRONJOB_RUNS_AS" and then manually invoke the command and make sure it works. Additionally, this is good for testing the job.

Answer 4

In step #1 (generate keys) when you get asked for a paraphrase you should hit Enter right away - you'll have a paraphrase-less key pair, then you can skip step #3 (configure ssh-agent).

Security wise, in this setup, if your ssh client gets compromised then the ssh server (where you are pulling from) will also becomes open to the adversary (as non-root if you are not logging in as root). That's not a big problem and it's a pretty common way of doing things. But try to do security updates on your Ubuntu systems periodically.

Anything simpler then than this setup will be pretty low security.

The options described by serverninja will get you higher security (better isolation between client and the server) but those setups have a larger configuration overhead and harder to debug.

Once you setup the password-less key pair (copy pub key to ~/.ssh/autorized_keys on the server), rsync will without any extra options just like ssh and scp.