2

Problem:

I don't have root access to the server (i.e, I can't/don't want to change any system-wide server configuration), and I want to use scp with an alternative Identity File (e.g, .ssh/id_rsa_for_scp) to automate the download of some files from the server, but I don't want the same key to be used to access the server through ssh.

9

After you copy your keyfile to the server:

ssh-copy-id -i ~/.ssh/id_rsa_for_scp legendaryuser@192.168.1.1

(To simplify the example, we will assume the client's machine ~/.ssh/config is already configured. For more details about ~/.ssh/config run man ssh_config)

Host testmachine
    Hostname 192.168.1.1
    User legendaryuser
    BatchMode yes
    IdentitiesOnly yes
    IdentityFile ~/.ssh/id_rsa_for_scp

You will need to edit the server's /home/legendaryuser/.ssh/authorized_keys file.

From:

ssh-rsa AAAAAC3nZCXExxHUEBR...

To: (this version allows download and upload)

command="if [[ \"$SSH_ORIGINAL_COMMAND\" =~ ^scp.? ]]; then $SSH_ORIGINAL_COMMAND ; else echo Access Denied; fi" ssh-rsa AAAAAC3nZCXExxHUEBR...

If you want to limit scp to "download-only mode" and only to files from a specific directory, do:

command="if [[ \"$SSH_ORIGINAL_COMMAND\" =~ ^scp[[:space:]]-f[[:space:]]/full/path/to/dir/.? ]]; then $SSH_ORIGINAL_COMMAND ; else echo Access Denied; fi" ssh-rsa AAAAAC3nZCXExxHUEBR...

And last, lets add some more restrictions to the key, just to be safe:

command="if [[ \"$SSH_ORIGINAL_COMMAND\" =~ ^scp[[:space:]]-f[[:space:]]/full/path/to/dir/.? ]]; then $SSH_ORIGINAL_COMMAND ; else echo ERRO Access Denied; fi",no-pty,no-port-forwarding,no-agent-forwarding,no-X11-forwarding ssh-rsa AAAAAC3nZCXExxHUEBR...

You can see more details about the authorized_keys file by running:

man sshd

Ps: You can also add from=xxx.xxx.xxx.xxx to the limit the use of the key from a specific IP address or network.

Pps: Sorry for my english, I'm not a native speaker.

  • Wow. Nice answer! :) – Jesse Adelman May 25 '17 at 22:51
  • Or use the scponly, which does basically the same without writing too much regexes. – Jakuje May 26 '17 at 8:25
  • @Jakuje, Yes, I could... if I had root access to the server. This solution is intended to help a user that doesn't have the power to make any changes on the system from which he needs to copy the files. – Michael Richard May 26 '17 at 12:25
  • 1
    You don't need a root access to set up scponly (if you download/install it in your home directory). It is nothing against your solution, but just for reference that there is already a tool to do that. – Jakuje May 26 '17 at 12:29
  • 3
    @Jakuje OK, cool. Why not put that as an answer and demonstrate? I'd love to see how, too. :D – Jesse Adelman May 26 '17 at 17:15

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.