Re: Permanent SSH Tunnel

The authorized_keys file is installed on the server side. You are correct that
it only contains the public key. But if someone else has root on the client
side, then he has access to the private key as well. 

Brian


On Wed, Sep 21, 2005 at 07:39:42AM -0400, JP Fielding wrote:
> am i missing something, isn't the authorized_keys files only public
> keys?  i would think that that should be something that doesn't need
> protection.
> 
> 
> On 9/21/05, Michael Bond <[email protected]> wrote:
> > This works great if you are the only admin on both boxes, but if
> > someone else admins the box as well (or, if you are not root at all)
> > and can see your authorized_keys file this isn't the best idea.
> >
> > One thing i've been playing with recently is using scripts to monitor
> > various things, and having the scripts report back to me (via rss)
> > when something goes wrong. This doesn't provide instant feedback (my
> > aggregator only checks every hour), but it does help to let me know
> > something is wrong with services i wouldn't be watching otherwise.
> >
> > Mike.
> > [email protected]
> >
> >
> > On Sep 21, 2005, at 6:09 AM, Brian Masney wrote:
> >
> > > Hey Dave,
> > >    You could also generate a SSH key with no password on the client
> > > (ssh-keygen -t dsa) and then add that key to ~user/.ssh/
> > > authorized_keys on the
> > > server. This is useful in scenarios where the SSH tunnel doesn't
> > > always have
> > > to be up.
> > >
> > > Brian
> > >
> > >
> > > On Tue, Sep 20, 2005 at 10:27:52PM -0400, David A. Riggs wrote:
> > >
> > >> Due to an unfortunate kludge of an integration project, I need to
> > >> rely
> > >> on an SSH tunnel providing access to a database on another host. The
> > >> server will only allow database connections from localhost. I've
> > >> got an
> > >> SSH tunnel set up as follows:
> > >>
> > >> $> ssh -fNL 3306:localhost:3306 user@dbserver
> > >>
> > >> which connects my local port 3306 (MySQL) via the SSH connection
> > >> user@dbserver, to port 3306 on dbserver *from* dbserver.
> > >>
> > >> My concern is that this solution is a fragile one, I fear that a
> > >> network
> > >> interruption will sever this connection at some point leaving my
> > >> local
> > >> application stranded from its database. I've not yet observed
> > >> this, but
> > >> I frequently have interactive SSH sessions broken and suspect this
> > >> one
> > >> could be broken as well.
> > >>
> > >> Can anyone suggest a more robust solution to this problem? I don't
> > >> have
> > >> a full grasp of stunnel, but it seems that it could be triggered from
> > >> inetd to perform this task perhaps? Could something like runit be
> > >> used
> > >> to reestablish the SSH connection if it fails? Is there some obscure
> > >> product that does exactly what I need?
> > >>
> > >> - David A. Riggs <[email protected]>
> > >>
> > >> _______________________________________________
> > >> Morlug mailing list
> > >> [email protected]
> > >> http://mailman.morlug.org/mailman/listinfo/morlug
> > >>
> > >>
> > > _______________________________________________
> > > Morlug mailing list
> > > [email protected]
> > > http://mailman.morlug.org/mailman/listinfo/morlug
> > >
> >
> > _______________________________________________
> > Morlug mailing list
> > [email protected]
> > http://mailman.morlug.org/mailman/listinfo/morlug
> >
> 
> _______________________________________________
> Morlug mailing list
> [email protected]
> http://mailman.morlug.org/mailman/listinfo/morlug
>