I see three maybe four problems. The shell is needless invoked, ssh's arguments aren't properly converted into shell literals, $status contains junk, and you might want to intercept SIGPIPE.

• The shell is needless invoked. You can avoid it as follows:

  my @cmd = ( '/usr/bin/ssh', '-i', $KEYFILE, "$USER\@$SERVER" );
  
  open($fh_null, '>', '/dev/null')
     or die("open /dev/null: $!\n");
  
  my $pid = open3($childin, $childout, '>&'.fileno($fh_null), @cmd);
  [download]

• ssh's arguments aren't properly converted into shell literals as far as I can tell. If you avoid the shell as shown above, it becomes moot. You'll be able to safely pass $KEYFILE, $USER and $SERVER.

• $status contains junk. $! is only meaningful after a system call that returned an error, yet you read it unconditionally.

  Furthermore, open2() "doesn't return on failure: it just raises an exception matching /^open2:/". You'll never actually reach that line if there's a problem. If you want to catch errors from open2 or open3, you'll need to use eval { }.

• Finally, if the child dies prematurely, you program will receive a SIGPIPE and die unless you intercept that signal (e.g. $SIG{PIPE} = 'IGNORE'; or $SIG{PIPE} = \&handler;).