Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know how to get a user to ssh into another box with a key:

ssh -l targetuser -i path/to/key targethost

But what about non-account users like apache? As this user doesn't have a home directory to which it can write a .ssh directory, the whole thing keeps failing with:

$ sudo -u apache ssh -o StrictHostKeyChecking=no -l targetuser -i path/to/key targethost
Could not create directory '/var/www/.ssh'.
Warning: Permanently added '<hostname>' (RSA) to the list of known hosts.
Permission denied (publickey).

I've tried variations using -o UserKnownHostsFile=/dev/null and setting $HOME to /dev/null and none of these have done the trick. I understand that sudo could probably fix this for me, but I'm trying to avoid having to require a manual server config since this code will be deployed on a number of different environments.

Any ideas?

Here's a few examples of what I've tried that don't work:

$ sudo -u apache export HOME=path/to/apache/writable/dir/ ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=path/to/apache/writable/dir/.ssh/known_hosts -l deploy -i path/to/key targethost
$ sudo -u apache ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=path/to/apache/writable/dir/.ssh/known_hosts -l deploy -i path/to/key targethost
$ sudo -u apache ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -l deploy -i path/to/key targethost

Eventually, I'll be using this solution to run rsync as the apache user.

share|improve this question
    
can you add the -vv option to your your ssh commands and post the output? It almost looks like the server isn't even using your key. Are you sure apache owns the key and is the only account with write access? –  Zoredache May 14 '10 at 22:42
add comment

3 Answers

Just create /var/www/.ssh/ and give apache write permission for it or change apache's $HOME to a directory where he can write.

share|improve this answer
    
The idea is to avoid having to manually configure each server to host this code. I can do what you suggest, or configure sudo on the host, the effect is the same. What i need is the right command(s) to have apache issue on it's own to make this request without further server configs. Are you telling me that this isn't possible? –  Daniel Quinn May 14 '10 at 22:22
add comment
up vote 0 down vote accepted

Zoredache had it. Not a single option I passed on the command line could save me as the private key file was set to 600 permissions and owned by my own user. My bad. Apologies to everyone :-(

share|improve this answer
add comment

how about adding the following to /etc/sudoers

someuser  ALL = (apache) NOPASSWD: /usr/bin/rsync [options]

that will allow someuser to run sudo -u apache /usr/bin/rsync [options] without a password (convenient for scripting... just explicitly insert the rsync options, so they can't do anything /but/ that.)

share|improve this answer
    
nevermind. i missed what you had posted. of course, the updated sudoers file could be sent in batch to all your servers... –  cpbills May 15 '10 at 19:44
    
personally, i'd do it with a user, other than apache, but that's me, and i don't know the full extent of what you're dealing with... –  cpbills May 15 '10 at 19:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.