Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As the question asks, how do I generate an ssh key for the user apache on Redhat?

My use case, is that we have a mercurial server running under the apache user. We also have several web servers clustered that we need to log on to manually and do pulls from. Ideally, what we'd like to do is have the mercurial server push all changes to all the webservers in the cluster. To do this, we want to use ssh, as setting up http mercurial servers on each of the web servers seems like too much work, and far too heavy.

What I've tried to do is the following:

> sudo mkdir /var/www/.ssh
> sudo chown -R apache:nobody /var/www/.ssh
> su - apache -c "ssh-keygen -t rsa"
    This account is currently not available.

I found the above commands elsewhere, but I can only assume that Redhat has differences to whatever distro was used for the above. Is there a way I can generate an ssh-key for the apache user?

share|improve this question

migrated from superuser.com Feb 5 '11 at 18:02

This question came from our site for computer enthusiasts and power users.

add comment

1 Answer

up vote 6 down vote accepted

Ok, I wasn't far off and I found a great resource which steps through the exact steps.

http://www.boredworkers.com/2009/08/24/script-tips-ssh-key-for-apache/

> sudo mkdir /var/www/.ssh
> sudo chown -R apache:nobody /var/www/.ssh
> sudo -u apache ssh-keygen -t rsa

I think I need to investigate the correct switches to use instead of relying on blog posts.

share|improve this answer
1  
Just an FYI, I assume your /var/www is available to the world. I highly recommend not putting your private key in that directory. There is no reason why it has to be under /var/www. Also there is no reason to over load the apache user for this syncing you are doing. I would use a different account that can also read the files or even use root. If you are pushing to each server using ssh all you need to do is add your public key into the authorized_keys for the accounts you are pushing to. –  ScottZ Feb 6 '11 at 4:24
2  
@ScottZ The webserver on which I'm doing this is only on the private network, and it's not set up to serve anything other than HG. I don't believe .ssh is exposed, but I'll confirm that thanks. Unfortunately, apache is the user that does the pushing, which is triggered from an external push. It ssh's to a local account, but as far as I'm aware, since it is initiating the ssh, the key must be supplied by apache. If there was a way around having apache do the ssh, I'd take it! –  Josh Smeaton Feb 6 '11 at 7:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.