1

So I want to set up this client on a server which downloads (SFTP) the error logs of several defined servers

Instead of having a configuration file containing the sftp credentials I am considering using privatekey files.

Anything that should be considered here or are there other options?

1

This is a perfectly reasonably approach, especially when you want to automate the downloads.

Considerations:

  • Make sure the credentials only give access to the log files and nothing else
  • Keep the private keys secure
  • Don't make the key lifetime too long a year, maybe 2 at the most
  • Use a long key and generate with plenty of entropy

That's about it. There are loads of tutorials on how to do this.

  • I'd just add that by secure - make sure that only the relevant user has read access to the key store (normally .ssh) and that that user with access to the keys is used for as little as possible - preferably it should be a single use user only used for this task – crovers Sep 12 '16 at 17:33
  • That's what I meant by point 2 but you explained it much better thanks. – Julian Knight Sep 12 '16 at 19:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.