RE: using SSH to execute commands on remote servers as different user

From: Dave [Hawk-Systems] (dave_at_hawk-systems.com)
Date: 07/29/03

  • Next message: Adam Maloney: "Re: Virtual Hosting Security" 
    To: <freebsd-isp@freebsd.org>
Date: Tue, 29 Jul 2003 13:24:47 -0400

    >I know this could pose as a security problem, but one of the things I do is
    >"shared-keys". Once you share the key with the remote server (in this case
    >your "sysadmin" account) that account will be able to log into the system
    >without a password.
    >
    >Example:
    >
    >Server A ---shared key for sysadmin-->Server B,C,D,E,F
    >
    >User sysadmin on server A now has access to B,C,D,E,F without the password.
    >
    >How to do it.(On Server A as user sysadmin)
    >
    >ssh-keygen -t rsa -s 1024 -f ~/.ssh/identity (or just ssh-keygen)
    >(.ssh/identity and .ssh/identity.pub will be created for you)
    >
    >cat .ssh/identity.pub | ssh sysadmin@ServerX 'cat >> .ssh/authorized_keys'
    >
    >You should be able to log into ServerX from ServerA as sysadmin.
    >
    >I jail my user and only give them access to the things I need. Again, this is
    >not secure if someone breaks into your ServerA and logs into remote machines
    >via sysadmin. So, make sure you take all of the necessary steps to locking
    >down that sysadmin user before doing the above.

    This is what we currently do for the sysadmin account. I however do not want to
    do this for other occasional accesses I need to establish to those boxes. More
    correctly, I want to allow a script to run the ssh occasionally as another user
    without placing an auth_key on the remote server which would give that user
    access on that server outside of the confines of the script(s) that we want to
    and outside of the limited time constraints that we require it.

    on serverA(our master) we have sysadmin account. Occasionally that account will
    need to connect to serverB or serverC as userA or userB account. I do not want
    to put a userA or userB account on serverA.

    I want sysadmin to connect to serverB as userA

    Again, easy to do from shell;
            ssh -l userA serverB command

    but how to pass the authentication portion from the script?

    thanks

    Dave

    _______________________________________________
    freebsd-isp@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"

  • Next message: Adam Maloney: "Re: Virtual Hosting Security"

    Relevant Pages

    • Re: SA PW
      ... with an account that has sysadmin role on the server (as she said, ... Protection Program and to order your FREE Security Tool Kit, ...
      (microsoft.public.sqlserver.security)
    • Re: Security
      ... What account is executing DTSRUN, ie, the batch component. ... > connection to the other server uses to sysadmin. ...
      (microsoft.public.sqlserver.server)
    • Re: SQL Server and Agent Accounts
      ... I log in to the server as a sysadmin. ... Here is a scenario that I tested: I created a Windows account called ... Apparently when SQL Agent logs in to the publisher it uses Domain\Maer. ...
      (microsoft.public.sqlserver.replication)
    • Re: Web server in CE 5.0 using ISAPI extensions
      ... SysAdmin is actually implemented as an ISAPI extension. ... resolve the problem of the file download (show the file name ... efficent way to realize a web server on CE. ...
      (microsoft.public.windowsce.app.development)
    • Re: The clock is running down on OS X "security"
      ... lets see how many security "experts" on this forum will continue ... Windows file sharing on an Internet server? ... So, Michelle, where do you work as a sysadmin? ... I agree with you that any sysadmin that is worth a flip should be keeping up with current patches, ...
      (comp.sys.mac.advocacy)