Locking Down ssh Authorized Keys

"The way .ssh/authorized_keys is typically used is not secure. Because using it securely is hard, and dumping in passwordless ssh keys is easy. I spent about 5 hours today locking down my authorized_keys.

"If you need to rsync multiple separate directories, it's easy to find several documents involving a validate-rsync.sh. Do not use, it is insecure--it allows rsync to be run with any parameters. Including parameters that allow the remote system to rsync in a new ~/.ssh/authorized_keys. Oops. (You can probably also trick validate-rsync.sh into running other arbitrary commands.) To be secure, you have to check the rsync parameters against some form of whitelist..."

Complete Story

Related Stories:

• Simple Shell One-Liner To Enumerate File Types In Linux and Unix(May 30, 2008)
• Simple Arithmetic In Bash, Perl and Awk--More Porting(May 29, 2008)
• Using Perl On Linux To Do Mass Synchronization Of File Time Stamps(May 28, 2008)
• Updating Debian Keys for the Uninterested(May 24, 2008)