I am using a Rails web app on the machine
webapp, from which I call an action, that pushes a file to a remote server
backend. Due to security reasons, we are using SSH keys and put the public part into
user@backend:~/.ssh/authorized_keys. The keys are restricted, so the Rails app does not have full control over
user, like this:
from="webapp",command="touch datafile; cat > datafile" ssh-rsa ...
The Ruby method looks like this
def self.push_file errors = `cat datafile | ssh -i id_rsa user@backend 'true' 2>&1` raise errors unless errors.empty? end
What the Ruby code does is, it
cats the file and then connects to
backend via SSH, where it executes the "command"
true, which then executes the command specified in the
user@backend:~/.ssh/authorized_keys file (create
datafile, write content). Lastly, the
stdout is overwritten by
stderr, so I can notice errors, which may occurr.
The solution works (it might be noteworthy, that
datafile is always <100KiB), but seems dirty in three ways:
- I am not using SCP for doing what is essentially a copy.
- Possible fix: Find a way to restrict SCP to allow exactly this operation, nothing else
- I am using neither
Net::SCP, but instead raw commands, the first is due to the need of pipes in order to execute the first command on
webappand the second one on
backend; and the latter due to the non-restriction of SCP.
stdoutis overwritten by
stderrin order to capture errors (least problematic, I know about
Any suggestions on how to make the solution cleaner?