I have server Alice and server Bob. Alice is locked down pretty tight and needs to stay that way. Bob is exposed to the public internet. From time to time I need to have Bob cause a script to run on Alice. ( the cause of the script might be from an external user or from a cron job on Bob.)
[I have full access to both machines]
This is trivial enough to do with SSH. However it means that the key to Alice is now stored on Bob. If Bob where compromised it could expose the key to Alice. (The paranoia runs deep enough that they are concerned that physical access to Bob could expose keys to Alice. I.e pulling the drive out of Bob and looking at it. Alice is locked in a separate room)
I am not looking to execute just any command. There are a few specific scripts on Alice that I need to fire off. (If there are fired off maliciously they will not really hurt anything)
My current game plan is to install Apache2 ( or some other secure CGI interface) on Alice and create CGI scripts that will do what I want. These would be called by Bob as needed. ( I may add security to the scripts to verify that Bob sent them)
So to fire off the script on Alice I would just do a GET from Bob to the script that I what run.
So all of that said: Does this make sense? What obvious thing am I missing here?
I am kinda answering my own question here. But I want to make sure I am doing it correctly before making a mess.
[a little more detail: the scripts themselves are pretty harmless, however having enough privilege to run the commands in the scripts could be a problem. Think 'rm oldlog' vs 'rm *'. The scripts also leave a bit more audit trail behind that could be bypassed by executing commands directly.]