Date: Tue, 8 Feb 2000 15:45:43 -0800 (PST) From: Sean Noonan <snoonan@cx952600-a.fed1.sdca.home.com> To: questions@freebsd.org Cc: noonans@home.com Subject: Best Practices question - ssh Message-ID: <Pine.BSF.4.21.0002081524040.5673-100000@cx952600-a.fed1.sdca.home.com>
next in thread | raw e-mail | index | archive | help
Hi List: The last issue of the Daemon News had an article about using MRTG to graph, amongst other things, CPU usage. The script used Perl to parse the output from the uptime command. I'm trying to extend that concept to graph CPU usage on another, remote host. I figured the shell script I need to make would be almost identical to the one presented in the Daemon News article, perhaps with some logging-in commands to the remote host. I want to do this securely, so have ruled out rlogin, rshell, etc. and have ruled in ssh. Here's the questions I have so far: 1. The only way I seem to be able to get ssh authentication to proceed in a shell script (e.g., without prompting for a password or a passphrase) is to have a "passphraseless" account. Isn't this inherently insecure? Isn't there a better way? What is it? 2. The cron job that runs the MRTG scripts every 5 minutes is run as root. Will this present additional problems authenticating without a passphrase? Is it even allowed? As an analogy, I can't ftp to my box as root, but normal user accounts can ftp 'till the cows come home (a "NOROOT" parameter rings a small bell). Is there a better way, say running the cron job as a different user? Or perhaps breaking apart the script into two seperate cron jobs, and only have the remote authentication portion run under the new userid? Both machines are 3.4-STABLE, running OpenSSH from the ports collection... Thanks as always, -Sean Noonan To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0002081524040.5673-100000>