I need a cron job to transfer a file across servers using scp and kerberos authentication. The system user for the job is in /etc/passwd on both machines and a valid keytab has been created (with -randkey) for the kerberos auth. The cron job script calls kinit, then scp, then kdestroy. However, the scp won't work unless I change the /sbin/nologin in /etc/passwd to a valid shell, say /bin/bash.

Question #1: is this a security hole to specify a shell?
Question #2: is this the "right" way to do this?

Thanks in advance


Answer 1: It may be. If you'd disable any other authentication method, and therefore forced use of the key and you believe this key to be strong, then a

Answer 2: With no valid shell scp will drop session before it transfers any files, which is a shame. It seems that scponly does what you want (http://www.sublimation.org/scponly/wiki/index.php/Main_Page).


question #1 usually isn't an issue, unless that user is root. There's also other layers you can use to limit access; iptables, tcpwrappers, the from= option in .ssh/authorized_keys, and pam_access to name a few.

Instead of using scp, which is a separate program and needs to be called with options from a shell, you could use sftp. On the server, set the service account's shell to sftp-server:

# RHEL systems
usermod -s /usr/libexec/openssh/sftp-server username
# debian systems
usermod -s /usr/lib/sftp-server username

Then call sftp in batch mode (-b batchfile) for non-interactive use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.