I have an application running on a dedicated (Ubuntu) server. There is also a desktop GUI which functions as dashboard for the application. I want to be able to start and stop the application from the GUI. To stop it, I simply send a command to the applications which makes it end its execution.

Starting however is not so simple. I want to use a small bash-script for it, however I do not know how I can securely invoke the script on a remote server from a client machine. Assuming the client machine gets compromised, I do not want to have anything happen to the remote machine (for example stolen SSH credentials for a user who can upload/download/execute files on the remote machine).

How can I securely invoke that script?

  • 1
    please do not cross-post on StackExchange – schroeder Jun 27 '17 at 6:48
  • My first question is why you would design your service in such a way that it requires the client to start it up. Why not use a server/client service model? – schroeder Jun 27 '17 at 6:51
  • @schroeder I have now deleted my post on AskUbuntu. My application is only used by me and a collegue of mine. It is supposed to run 24/7, but it is not very far developed yet and crashes sometimes. I want my collegue to be able to restart it from the GUI when I am not at hand. – thesys Jun 27 '17 at 6:54
  • 1
    In that case can't you have it restart the process on crash ? I don't know the Linux commands for that but in windows task scheduler you can have it restart on crash so I assume you can on Linux. – ISMSDEV Jun 27 '17 at 7:02
  • 1
    I wonder why is this question is being down voted, it is a concise and valid question – Vicente Adolfo Bolea Sánchez Jun 28 '17 at 7:58

If you just need to remotely execute an script you can just use ssh server shell_script_path. By using ssh you can just rely on its security.

If you do not need authentication to start/kill the service, maybe adding Xinetd entry will enable access control.

  • Two critical points in the question probably still need attention: 1. "Assuming the client machine gets compromised" 2. "for example stolen SSH credentials" While using SSH built-in security is a good idea, will it cover a situation that involves both the above? – Sas3 Jun 27 '17 at 9:07
  • Right, he can just use password instead of asymmetric key exchange for ssh authentication – Vicente Adolfo Bolea Sánchez Jun 27 '17 at 9:15
  • Still using the asymmetric key authentication he can delete it from the server if he thinks that the client machine has been compromised – Vicente Adolfo Bolea Sánchez Jun 27 '17 at 9:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.