I run a shared RH server at work. I recently added a standalone data aquisition box, and since it could be an attack vector, I want to be smart about securing it.

Security of the DAQ itself doesn't matter. It runs Debian. Because the DAQ is used by technicians, it has autologin and public password. The scary part is that it needs to upload data to the RH web site at odd intervals, but I don't want anyone, even if they root the DAQ system, to be able to cause trouble on the RH server.

Right now the DAQ shared user is user Bob that does not exist on the server. It rsyncs the data to the webserver through ssh. When it does so, it ssh's as a user Charlie on the RH server with public key auth. The directory in the web root for the data and the files there are owned and grouped Charlie; Charlie is not in any other groups including the web- users group.

In principle now the entire world can log onto the webserver via ssh as Charlie. I am looking for suggestion on how to do this differently, or better sandbox that user. The only thing Charlie should be allowed to do is rsync legitimate data files to 1 directory in the web root. Can I remove Charlie's shell altogether and still allow him to use rsync?

Any chance you can reverse the ssh direction, so the DAQ is a stand-alone system and a user on the RH server automatically rsyncs the data from the DAQ?

I considered that, but I want the data available on the server within seconds of measurement. The only thing I could think to do was run a cron script on the server to rsync every 30 seconds or something but that is a lot of unneeded processing considering the DAQ may be off for days at a time and only does a measurement every 10 minutes in use. Maybe that would be OK though.

Understandable. How about if the DAQ sends the data to an unprivileged and jailed account who can only see its own home directory and supporting directories with no shell access? You can use jailkit to set this up easily.

The DAQ would use sftp to dump the file to the jailed user's home, then you have a second script running as Charlie go grab those files when they appear and put them in the proper location in the web root.

You'd want to sanitize the files to make sure there isn't anything malicious in them, but you'd have to do that regardless.

I will look into jailkit. I do not currently know how to jail users.