kevinarpe's questions

I am adding a new task to a Windows Server as local admin. At the bottom of the Create Task dialog, I see an option "Configure for". What is the meaning of these choices?

To be clear, this screenshot is from Windows Server 2016 (but I cannot a tag for that version).

I want to setup SSH keys to automate scp jobs. My current assumption is that "automate" implies SSH keys without a password, but I am open to your suggestions.

I did a lot of Googling before I asked this question. Here is what I found:

• Lots of pages explain how to configure SSH keys without a password
• Very few pages explaining the security implications of SSH keys without a password

Thus, this question is a prime candidate for what Jeff Atwood calls "Making the Internet a Better Place".

For the purpose of this question, imagine this config:

• Source 1 (not controlled by me): user1@host1
• Source 2 (not controlled by me): user2@host2
• Source X/Y/Z (not controlled by me): etc.
• Destination (controlled by me): user3@host3
• Goal: Setup "jobs" (scripts, whatever) to copy files from user1@host1 and user2@host2 (etc.) to user3@host3 using scp

I already know about:

• ssh-keygen to generate SSH keys
• SSH keys can have empty/no password
• ~/.ssh/id_dsa has the private key
• ~/.ssh/id_dsa.pub has the public key
• Copy ~/.ssh/id_dsa.pub into ~/.ssh/authorized_keys and carefully set its file permissions
• Share contents of ~/.ssh/id_dsa.pub with other user/host to use with scp

In my own testing between different hosts/users, I know my setup works.

What troubles me are the security implications. And, I confess that I am not a Linux admin, nor a security expert.

• If I give this public SSH key to another division to use with scp, what if that same key is leaked/lost/stolen to another division?
• Does this imply anyone with access to this public SSH key can use scp against host3 as user3 without a password?

Important assumptions to consider for your responses:

• I do not care about external hackers via the wider Internet. These are Linux boxes on a secure corp network.
• I cannot setup additional user IDs.

I am guessing there is a way to restrict access for a specific SSH key, but I don't know how. Maybe ~/.ssh/authorized_keys options (which I just learned about today)? Is it possible to have multiple SSH keys -- give a different key to each source?

Please advise The Right Way.

AutoSys R4 has a variety of command line tools. Example: jil (UNIX) and jil.exe (Win32) let you insert/update/delete box and job definitions using a script.

Is there an equivalent command line tool for jobprofiles.exe? I searched hard on Google and found nothing. Oddly, all the FAQs I see avoid any discussion of job profiles. Why is this?

Currently, there is no way (as a regular user) to dump an entire jobprofile. This would be useful for many reasons, including comparison to other jobprofiles, e.g., PROD vs UAT.

FYI: AutoSys R4 job profiles allow you to set certain environment variables when your process runs. Example: MY_CONFIG_VAR=1234

I have a contractor is using a Windows PC that is outside the corporate network. However, we allow connections via the firewall to certain hosts/ports. Telnet/23 from the contractor's PC to a specific AS400 (iSeries) server is not allowed.

I want to create a pair of SSH tunnels using a Linux box inside the corporate network.

Here is my proposed setup:

OutsideWindowsPC <-> { Internet } <-> InsideLinuxServer <-> InsideAS400Server

We can grant access to certain ports on the Linux server inside the corporate network.

I know it possible to do this, but I cannot stitch the complete solution myself. To be safe, the solution needs to be scalable to about 10 contractors each with their own PC.

In the end, we want to telnet/23 from the contractor's Windows PC to the AS400 server on the corporate network.

Finally, I realise in an ideal world, we would tunnel directly to the AS400 server, or use a secure protocol to connect to the AS400 server. However, politics prevents this type of solution!