Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently have a bash script running on my Linux server that once a week goes through my repositories, performs some tasks, and backs them up remotely.

Today I started backing up some remote repositories as well. My plan was to be able within the backup bash script run something like (cd $dir && git pull origin master 2>> $LOGFILE) inside a for loop. The problem I seem to be having is that I'm trying to pull some stuff from github and that requires my private key file to be unlocked before proceeding. Is there any way that I can provide that password beforehand so that I don't get an interactive prompt for the password?

share|improve this question
    
Hmm, this seems only tangentially server-y. This question might be better hosted at Super User. –  Chris Johnsen Sep 24 '10 at 6:36
    
Really? A backup cron job executing a bash script is not server-y? –  enriquein Sep 24 '10 at 13:57
add comment

2 Answers

up vote 1 down vote accepted

Use SSH agent forwarding. You will have to use an agent on your initial machine; you will also have to have agent forwarding enabled in your client and on your Linux server.

Assuming OpenSSH all around:

test -z "$SSH_AUTH_SOCK" && eval "$(ssh-agent)"
ssh-add -f /path/to/your/key-accepted-by-GitHub
ssh-add -f /path/to/your/key-accepted-by-your-user-on-the-linux-box
ssh -A userName@theLinuxBox /path/to/the/script

The sshd on your server (“yourLinuxBox”) will have to allow agent forwarding (AllowAgentForwarding in its sshd_config file; it usually defaults to “yes” if not present).

With your local agent holding the GitHub key and with agent forwarded through your SSH connection to the Linux box, any normal use of ssh on the Linux box that needs the key (e.g. git pull) will be able to use.

Or, you can use an entry in your .ssh/config to specify the bits of the “first leg” to abbreviate the last two commands as ssh backup-server /path/to/the/script (you will still have to make sure the GitHub key has been added to your local agent):

Host backup-server
    HostName     theLinuxBox # name or IP
    User         userName    # username on remote system
    IdentityFile /path/to/key-accepted-by-your-user-on-the-linux-box
    ForwardAgent yes

Note: Do not enable agent forwarding to untrusted servers (root on the server could use its local access to use keys stored in your local agent).

share|improve this answer
    
Although what you suggested was a bit of overkill, it led me down the path of what I actually needed. Googling for ssh-agent I found this link: ibm.com/developerworks/library/l-keyc2 which covers my needs perfectly (especially when combined with keychain). Marking you as correct answer because it was close enough. –  enriquein Sep 24 '10 at 20:09
    
There's an even more elaborate script, which covers more edge cases available here: help.github.com/ssh-key-passphrases –  metavida Oct 4 '11 at 1:40
add comment

I think it's a better idea to do the backup as a different user, since your private key probably allows access to other places as well. Give this user a private ssh key without a password and use this user in your scripts. On the remote git server, you can limit the other users permissions so that only your git repos can be pulled.

share|improve this answer
    
Currently I only need that private key for GitHub access. This job runs as root as a cron job once a week. I'm the only user in the server which this is running, which is primarily a backup/file server. I guess I could just use a key w/o a password for GitHub. Going to Google for cons of this approach. –  enriquein Sep 24 '10 at 14:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.