So I want to set up this client on a server which downloads (SFTP) the error logs of several defined servers

Instead of having a configuration file containing the sftp credentials I am considering using privatekey files.

Anything that should be considered here or are there other options?

1 Answer 1


This is a perfectly reasonably approach, especially when you want to automate the downloads.


  • Make sure the credentials only give access to the log files and nothing else
  • Keep the private keys secure
  • Don't make the key lifetime too long a year, maybe 2 at the most
  • Use a long key and generate with plenty of entropy

That's about it. There are loads of tutorials on how to do this.

  • I'd just add that by secure - make sure that only the relevant user has read access to the key store (normally .ssh) and that that user with access to the keys is used for as little as possible - preferably it should be a single use user only used for this task
    – crovers
    Sep 12, 2016 at 17:33
  • That's what I meant by point 2 but you explained it much better thanks. Sep 12, 2016 at 19:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .