Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have already set up a public key to automate the login on remote server for my user.

So this is running without any problem from cli:

rsync -r -a -v -e "ssh -l user" --delete ~/local/file 111.111.11.111:~/remote/;

But, when I try to run the same from a PHP script (on a webpage in my local server):

$c='rsync -r -a -v -e --log-file=FILE "ssh -l user" --delete ~/local/file 111.111.11.111:~/remote/';

//exec($c,$data);
passthru($c,$data);
print_r($data);

This is what I receive:

2011/01/23 19:18:29 [6401] rsync: connection unexpectedly closed (0 bytes received so far) [sender] 2011/01/23 19:18:29 [6401] 
rsync error: unexplained error (code 255) at io.c(601) [sender=3.0.7] 

The permissions qre set like this:

Local:
chmod 600 ~/.ssh/local-rsync-key
chmod 600 ~/.ssh/local-apache-key
chmod 700 ~/.ssh/

Remote:
chmod 600 ~/.ssh/authorized_keys
chmod 700 ~/.ssh/
chmod 700 ~/

I registered two keys on ~/.ssh/authorized_keys:

user@localserver
apache@localserver

I went dry of ideas... I guess I have to do something else in the remote /etc/ssh/sshd_config file. I am running Nginx in both servers. Thanks for any help.

UPDATE:

While I cannot get rsync, this is how I got to transfer the file from local to remote:

if($con=ssh2_connect('111.111.11.111',22)) echo 'ok!';
if(ssh2_auth_password($con,'apache','xxxxxx')) echo ' ok!';
if(ssh2_scp_send($con,'localfile','/remotefolder',0755)) echo ' ok!';

Local file needs: 0644 Remote folder needs: 0775

I also read this suggestion: "I don't think you want to "copy the key somewhere where apache can get to it" - that's a security violation. Better to change the script to run as a secure user and then setup the .ssh keys for passwordless login between servers.

If somebody know how to do this, please, it would be of great help.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

try -e "ssh -l user -i <keyfile>"

When ran on commandline, ssh use the keyfiles on $HOME/.ssh/, but under PHP, it's ran using Apache's user, so it might not have a $HOME; much less a $HOME/.ssh/id_dsa. So, either you specifically tell it which keyfile to use, or manually create that directory and its contents.

share|improve this answer
    
Well I created the folder /home/apache/.ssh and put the key inside, changed the permissions and nothing... I tried to put the key in a folder that php is already writing files and nothing... I am thinking of changing the php user, is it possible? –  Roger Jan 24 '11 at 3:15
    
Is this what you are suggesting? unix.com/shell-programming-scripting/… –  Roger Jan 24 '11 at 3:18
    
first try with -i <keyfile>; making ssh find the key by default can be harder because a) i don't think /home/apache/ is the $HOME of the user Apache is running under. b) if there's no shell, it's unlikely that the $HOME variable is even set. –  Javier Jan 24 '11 at 12:11
    
as for your update regarding security, you're right: making the keyfile available to Apache is risky; but no matter where you put it, if you want ssh to get to some other machine without asking, you're already giving Apache full power over two machines. The solution is to create a new keyfile (not your personal one), and on the other machine limit that key (on authorized_keys) to just use scp (no remote shell), and to a single directory. or you could put chrooted copy of ssh on that directory, with it's own tightly restricted authorized_keys –  Javier Jan 24 '11 at 12:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.