2

I have a need to scp a bunch of files from a production box to my development environment. I am a developer and have limited read access to the production machines. Instead of entering password for each file, I wanted to create a keypair in production and store the public key in authorized_keys on my dev machine.

The key is for my LDAP login to production. Is this safe? Can something go wrong here? Thanks.

The production machines are not web facing. The machines are in the company data-centers and are "supposed to be" only accessible from within the corporate network.

  • 1
    This would mean that if production is compromised then so is your dev machine. wouldn't it? Depending on what is being deployed in production this may be a greater or smaller issue. How likely is production to be compromised, compared to dev? – Lyndon White Sep 23 '14 at 12:29
  • With this I can copy files from Production to dev but not dev to production. If Production is compromised, it should not affect my dev box directly. The public key in the .ssh folder can be copied to some other environment but still that key is valid only for my account. – pslk Sep 23 '14 at 13:04
  • If production is compromised, then the password hashes can be taken. Your account could be compromised sooner or later, then the dev machine. In theory the password hashes are unbreakable. but in theory the Production machine wouldn't be compromised. (I could be wrong about this, i'm no expert or I would be answering.) The comment is, "Consider clarifying your question, with a threat level for Production. Eg is is web facing etc" – Lyndon White Sep 23 '14 at 13:08
2

If you're doing this to avoid entering passwords, then that implies that either you'll run an SSH agent on Production, or you'll keep an unencrypted private key there. If it's the latter, then the administrators of Production will have access to your development box.

But if I'm reading between the lines correctly, you're using this approach as a workaround because you can't add your dev key to authorized_keys on Production. In that case, there's a better way to get what you want.

If you're using OpenSSH, you can avoid entering the password multiple times even with password-based access, by using SSH connection sharing. Once you've configured this, you SSH into the server normally in one window, typing in your password as normal. In another window, you do your copying, and your SCP client finds and uses the existing connection with no password entry required.

To set this up:

$ mkdir ~/.ssh/cm_socket

And add the following to your ~/.ssh/config:

ControlMaster auto
ControlPath ~/.ssh/cm_socket/%C
ControlPersist no

After this, SSH and SCP will look for a shared connection by default. If you want to make a second, non-shared connection for some reason, you can add -S none to your command line.

For more info:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.