I have server Alice and server Bob. Alice is locked down pretty tight and needs to stay that way. Bob is exposed to the public internet. From time to time I need to have Bob cause a script to run on Alice. ( the cause of the script might be from an external user or from a cron job on Bob.)

[I have full access to both machines]

This is trivial enough to do with SSH. However it means that the key to Alice is now stored on Bob. If Bob where compromised it could expose the key to Alice. (The paranoia runs deep enough that they are concerned that physical access to Bob could expose keys to Alice. I.e pulling the drive out of Bob and looking at it. Alice is locked in a separate room)

I am not looking to execute just any command. There are a few specific scripts on Alice that I need to fire off. (If there are fired off maliciously they will not really hurt anything)

My current game plan is to install Apache2 ( or some other secure CGI interface) on Alice and create CGI scripts that will do what I want. These would be called by Bob as needed. ( I may add security to the scripts to verify that Bob sent them)

So to fire off the script on Alice I would just do a GET from Bob to the script that I what run.

So all of that said: Does this make sense? What obvious thing am I missing here?

I am kinda answering my own question here. But I want to make sure I am doing it correctly before making a mess.

[a little more detail: the scripts themselves are pretty harmless, however having enough privilege to run the commands in the scripts could be a problem. Think 'rm oldlog' vs 'rm *'. The scripts also leave a bit more audit trail behind that could be bypassed by executing commands directly.]

  • Why not just create a service account on Alice that Bob logs in with that only has permissions to execute the handful of scripts that need to be run.?Do any of these scripts need to be run with root privileges? Is there another consideration I'm missing - that seems like the easiest way to me. Even if the SSH key is lost it doesn't have rights to do anything nefarious. – RobertRSeattle Aug 27 '17 at 20:23

"Apache2 ( or some other secure CGI interface) on Alice" is much more than you need, would add complexitity, and vastly expand your "threat surface". A simple Perl script on Bob, watching for trigger events, and listening for connections on some port; plus a requestor Perl script on Alice that connects to the port on Bob and reads the events would be easier.

I recall the examples from the Programming Perl book (O'Reilly) have a similar thing.

"If there are fired off maliciously they will not really hurt anything"? Really? What if they're repeatedly fired off, as fast as the full power of a subverted Alice can do it?

  • "power of a subverted Alice"... in MY case, no. At best you will annoy a sysop with text messages once a minute. But point well taken! I do want the response to be some what snappy so would it make more sense to have Alice listen for connections from Bob vs (I think you are suggesting) have Alice pol Bob for events. Either way thank you for pointing out the obvious! (I need that some times ;-) – Burtski Aug 27 '17 at 21:19

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.