Fedora Users — Re: Passing password in ssh

Aldo Foot wrote:

2008/1/22 Mikkel L. Ellertson <mikkel@xxxxxxxxxxxxxxxx

You are correct. My worst nightmare does not include stealing the private
key. But simply cracking into a user's account who has access to several
systems containing the keys.

Worst scenario is when someone brakes into a system gains root access
and does "su - user" to such account and by looking into the .shosts tries
his luck to other systems.

Yes, that is a problem. You can only hope that such a user wouldhave good pass phrase(s) on their key(s). Though I would expect theattacked to have more luck using the information in known_hosts topick targets. If you only use "unlocked" keys for cron jobs, andthen limit access on the remote system, you can keep the riskmanageable. I can picture a cron job that does a backup to a remotemachine, or a backup client that uses an ssh link to communicate toa backup server on a remote machine using "unlocked" keys.



    But even having a pass phrase does not help if someone uses dumb
    passwords. Things like first name as user name, and last name as
    password. Then they use their full name as the pass phrase on the
    key. Or is machine B lets you ssh in using username/password, and
    you have a user like this. The key is to use the tools responsibly.


Bingo!  There lies my problem.

Perhaps a good practice is to configure accounts such as those for
cron jobs to use only specific commands.
Does anyone reading this thread uses such setup?
I'll play with this a bit.

You may want to look into the -r option of bash, or rbash. (Bashinvoked as rbash is supposed to be the same as running bash -r.)This, or another or the restricted shells would work well as theshell for user on the remote machine. You can also look into sudo togive limited access to commands that need to be run as root, if whatyou are doing is going to require it. (man bash and search for rbash)

I have not used it, but rssh also sounds like it might be useful,depending on what you need to do. It is designed to be used as theusers shell on the remote machine when you want to limit what theycan do over a ssh connection.


http://www.pizzashack.org/rssh/

Another option, if you only need to run a specific command, would beto configure the key in authorized_keys so it runs a specificcommand. (man sshd and search for AUTHORIZED_KEYS FILE FORMAT)


Mikkel
--

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

Attachment: signature.asc
Description: OpenPGP digital signature