Date: Thu, 19 Jul 2001 00:54:06 +0200 From: Alson van der Meulen <freebsd@alson.linuxfreak.nl> To: security@FreeBSD.ORG Subject: Re: Piping and scripts with scp Message-ID: <20010719005405.E15065@md2.mediadesign.nl> In-Reply-To: <4.3.2.7.2.20010718160356.04478100@localhost> References: <200107181959.NAA06459@lariat.org> <200107181959.NAA06459@lariat.org> <4.3.2.7.2.20010718160356.04478100@localhost>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Jul 18, 2001 at 04:23:03PM -0600, Brett Glass wrote: > At 02:04 PM 7/18/2001, Alson van der Meulen wrote: > > >You really should use RSA keys without passphrase for this, > > The problem with un-passphrased RSA keys is that they provide > no more security but create logistical problems. Since > the script will be run by cron as root, it means either > generating an un-passphrased key pair for root (not wise!) > and/or generating a special key pair for the script, which > is stored... where? In whose directory? There's no convention > for this, so the next admin who comes along will have to figure > out what's what. Second, the RSA keys afford no additional > security, since if someone breaks root and gets the > un-passphrased key pair he's home free (just as if he'd plucked > an unencrypted password out of a batch file). So, overall, we > have a bunch more complexity and many more things to go wrong > with no security benefit. ssh-keys arent more complex then passing passwords from a script to ssh, since ssh isn't designed to read passwords from stdin or some file. you can just document the location of the keypair in your script, and add it to the remote root's ./.ssh/authorized_keys, shouldn't be that complex imho.. > > BTW, from what people are telling me, scp doesn't allow data > to be piped into it (as does ftp), which means I have to > use ssh and invoke "cat" (or something similar) on the other > side. A bit awkward. (Perhaps using "-" to mean standard input > or output should be allowed in scp, as it is in so many > other utilities. Or maybe the ftp "|" syntax could be used.... > The latter is more complex because scp would have to fork a > shell and execute the command as a data source/sink.) scp actually does something like cat foo | ssh bar cat \> fo To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010719005405.E15065>