3

I have a situation where a cron job needs to upload files to at least 2 different SFTP servers. We only have logins, so using SSH keys as suggested in another answer won't work. So given the example:

  • SFTP Server 1
    • someusername
    • somepassword
  • SFTP Server 2
    • someusername
    • somepassword

Is there a standard, secure way to store passwords for 2 or more SFTP logins, that can be accessed by a shell script?

4
  • 2
    Why can't you set up ssh keys? If you have sftp access, you should be able to upload the appropriate public keys. – Michael Hampton Jan 16 '18 at 20:13
  • @MichaelHampton Good question! The SFTP accounts are not set up to allow access to home directories, so I can't upload a public key. – Robert Dundon Jan 16 '18 at 20:32
  • 1
    Please find the admin of the SFTP server and let them know that they are making everybody's security harder by not supporting ssh keys which are recognized as an industry best practice. – chicks Jan 16 '18 at 22:58
  • @chicks It's a company we work with, but OK 😛 – Robert Dundon Jan 17 '18 at 14:01
3

The standard way is to store them in plaintext files, and secure them with filesystem permissions. This is as good as the security of the accounts that can read them, and your ability to keep those permissions in place over time.

There's a tendency for locked down permissions to get looser as different applications write to the files or their directories over time. Directory ACLs can help, for example:

setfacl -m d:g::-,d:o:- /secret/dir

to try to enforce empty permissions for group and other whenever new files are written in the directory - for example if an editor creates a new copy of the password file, instead of updating the original file.

If you want to use ssh keys instead, you could store the secrets in plaintext on another host that only allows login by ssh keys. You'd have to script logging on on that host, reading the password file, then using it in an ssh command. That would be hard to do reliably and securely, but it could work.

Most options you can think of ultimately rely on filesystem permissions for their security. Chapter 11 of SSH: The Secure Shell has a discussion of the trade-offs.

2
  • I was thinking config files (which are pretty much plaintext). So the general idea is to trust the file permissions/ACLs to be "secure enough" for safeguarding login info? – Robert Dundon Jan 16 '18 at 20:34
  • 2
    Yes. I added a little more about this. – Andrew Schulman Jan 16 '18 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.