Task Based Security Contexts

I was messing around with ssh trying to figure out how to give cron access
to another machine for backup with rsync. I was thinking I could run
ssh-agent and ssh-add every time the backup server is restarted and save
the ssh-agent evironment export string:

SSH_AUTH_SOCK=/tmp/ssh-XXhHpNdn/agent.2892; export SSH_AUTH_SOCK;

and then source this from the cron script. Unfortunately so can anyone
else if an account is compermised all hosts with the public key in the
authorized_keys file for that account are compermised even if you use
ssh-agent.

So my question is; will Linux ever support key management at the task
level? Meaning, it would be far better and more secure if a security
context object could be associated with a task. It could be inherited
bestowing the privledges associated with it on to children. The security
context could maintain additional capabilites not attributed to the
default context (e.g. mount a usb camera). This functionality might take
advantage of TCPA hardware. But other processes, even those of the same
user will not be granted these privedges.

This seems superior is it not? Will Linux ever support such a feature?

Thanks,
Mike

Michael B Allen <mba2000@ioplex.com> wrote:
> I was messing around with ssh trying to figure out how to give cron
> access to another machine for backup with rsync. I was thinking I
> could run ssh-agent and ssh-add every time the backup server is
> restarted and save the ssh-agent evironment export string:
>
> SSH_AUTH_SOCK=/tmp/ssh-XXhHpNdn/agent.2892; export SSH_AUTH_SOCK;
>
> and then source this from the cron script. Unfortunately so can anyone
> else if an account is compermised all hosts with the public key in the
> authorized_keys file for that account are compermised even if you use
> ssh-agent.

First, get keychain and let it worry about what to export and where to
save it. Second, is there any reason that you can't generate a key pair
that is only used by the two hosts in question, and moreover, just for
the task of running the backup? You could also have special backup
users on both machines as well, or a passphrase-protected key, etc.

--
Jeremy A. Gray
gray@metacomet.net

"Remember the Pueblo." -- the Fourth Law of Marvin