1

I have access as a regular user (not as root) to two servers. Server A is accessible via ssh with a username and password, Server B can only be accessed using a keycard and pin. I need to set up a cron script on Server B so that data can be transferred from Server B to Server A at regular intervals for processing (processsing is done on Server A and at the moment I do the transfer manually).

The question is: What is the most secure way to do this? If I set up an ssh id from Server B to Server A, how can I make sure that if someone were to gain access to Server B could not just simply ssh into Server A and hack Server A as well? Ideally I would need to restrict access from Server B to Server A to a single folder; this would have been streoightforward if I had root permissions but I am only a regualr user.

Any ideas? Thanks

1
  • 1
    If you're not an admin on Server A, you need to check with the admins before you set up any automated remote access to the machine as the admins may have policies in place that prohibit this. – Neil Smithline Sep 16 '15 at 19:03
1

If your server B has fuse and sshfs installed and both servers are permanent (fix ip, 24/7) your best choice is to user-mount the other server's directory and copy files over that channel.

On serverB:

$ mkdir $HOME/serverA
$ sshfs youruser@serverA.domain:restricteddirectory serverA

from now, your scripts on serverB can copy files into $HOME/serverA. This is reasonably secure solution. Since the channel is set up manually, no password, no unprotected key-files can be stolen. Furthermore the possible attacker will be unable to escape from restricteddirectory on ServerA. All goals are reached. The backside is that you have to remount the directory every time (either) server reboots. In enterprise environment this might be a minor problem, and you can set up a script/cron to check the connection and send you a mail if the other side is unavailable (so you can log in and fix the problem).

If the server has dynamic IP or offline often this approach won't work. Using automated scripts for accessing serverA will require you to store your password or unprotected priv-key on serverA, therefore there is no way to prevent successful attacker of serverB to reach serverA with your privilege level. (However this absolutely doesn't mean that (s)he can "hack Server A". You are unprivileged user. But your account will be compromised for sure).

In fact, you might try to fiddle about screen and ssh-agent to avoid storing credentials, but you will face one of the problem before, if serverB reboots you have to login and fix things.

The only truly secure solution which comes into my mind in this case to use some intermediate storage. Set up an account at a third place (serverC), restrict access to serverA and serverB's IP address and you can proxy all data easily. At serverA your pull scripts will get the data. Because you never access serverA from serverB, your account cannot be hacked even if serverB silently compromised at root level.

1

What is the most secure way to do this? If I set up an ssh id from Server B to Server A, how can I make sure that if someone were to gain access to Server B could not just simply ssh into Server A and hack Server A as well? Ideally I would need to restrict access from Server B to Server A to a single folder; this would have been streoightforward if I had root

You can use rsync with a lockdown SSH key to restrict the access from Server B to Server A. I am getting the instruction from this write up.

  1. Create a pair of SSH keys on Server B
  2. Add the Server B SSH public key to ~/.ssh/authorised_key on Server A
  3. Run your rsync command on Server B to make sure it copies the file to Server A (If you don't know how to run rsync, read this guide).

Hardening Rsync over SSH

Only authorise your rsync command to be executed through SSH key

Edit ~/.ssh/authorized_key and add your exact rsync command that you are running on on Server B

command="[YOUR RSYNC COMMAND WITH ALL OPTIONS]" ssh-rsa AAAAB3NzaC1y[...]

Disable port forwarding, pty and agent forwarding

Edit ~/.ssh/authorized_key with the following

command="[YOUR RSYNC COMMAND WITH ALL OPTIONS]",no-pty,no-agent-forwarding,no-port-forwarding ssh-rsa AAAAB3NzaC1y[...]

Now if you try to SSH from Server B to Server A, it will not authorise any access.

Note: I am assuming you can SSH to Server A using SSH key. Otherwise, you can do this process other way around: SSH from Server A to Server B using a SSH key and pull the files using rsync.

2
  • Bypassing 2FA by using "SSH from Server A to Server B" seems a bad idea. 2FA is there for a reason. – Neil Smithline Sep 17 '15 at 4:33
  • @NeilSmithline, if Server B is properly configured, I hardly think you can bypass 2FA by a simple public key auth. But true, that shouldn't be a solution. B->A rsync is a valid option although. – goteguru Oct 2 '15 at 10:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.