On Fri, Apr 09, 2004 at 12:21:33PM -0700, Brent Wiese wrote:
> Here is what I need to do:
> I need to somehow automate an rsync from 1 box to several others.
> I have set up SSH for RSAAuthentication, the method I'd prefer to use (over
> RHostsRSA).
> I am able to slogin to the other boxes w/o supplying the passphrase.
> But here is where I'm stuck. How do I make a script run w/o the passphrase?
> The goal is to put this script in the users crontab.
> I've googled for help on this, which is how I got to the point I'm at, but
> now I need some further guidance.
> I am notified by email when the boxes reboot, so logging back into them to
> add the passphrase back into memory isn't a problem. I'd rather not use
> Rhosts if I can avoid it, and I also want to avoid running rsync daemon.
> If anyone has suggestions on a better and/or more secure method to do this,
> happy to hear it.
> Ultimately, I'd also like to be able to trigger this sync from a webpage, so
> if anyone has done that (using sudo I'd imagine), feel free to suggest
> things there too.

This is covered in the SSH FAQ --

Since you have ruled out RhostsRSA, you're left with two options:

   i) SSH key with plaintext key file (ie. no passphrase).  If you
      choose this method, be sure to read the section in sshd(8) about
      the options you can use in the ~/.ssh/authorized_keys file, to
      minimize the possible damage that could occur if that key gets

  ii) Public key with SSH agent.  Read about ssh-agent(1) and
      ssh-add(1).  For scripting purposes, you can start up a
      long-running ssh-agent process, saving the output to a file:

        # ssh-agent -s > ssh-agent-env

      Then manually ssh-add the key and passphrase to that agent:

        # sh -c '. ssh-agent-env ; ssh-add my-remote-access-key'

      All your scripts need to do then is source the environment
      settings you saved:


        . ssh-agent-env

        [... etc ...]

In either of these cases be sure that each machine has the ssh public
key of the other in the appropriate known-hosts files and that you
verify that you can use ssh with your key on the command line to get
into the machine without being challenged for a password.



Dr Matthew J Seaman MA, D.Phil.                       26 The Paddocks
                                                      Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey         Marlow
Tel: +44 1628 476614                                  Bucks., SL7 1TH UK

Attachment: pgp00000.pgp
Description: PGP signature

Reply via email to