sudo with -u via ssh -t in a crontab

Question

I'm trying to create a cron job that uses ssh to login to a remote server and run a script as a different user. I try:

* * * * * source $HOME/.keychain/$HOST-sh && sudo -u $USER $PATH/$SCRIPT

but this doesn't work because there is no -t option specified for ssh. The cron job needs to source the keychain file in order to work without a password, but I'm not sure where to include the -t option for ssh in this instance.

Answer 1

You don't need keychain.

use ssh-keygen, make new key pair. deply the public key on target server and prefix it with command like this

command="/bin/ls" ssh-dss YOURKEEEEEEEYHERE ==comment

in .ssh/authorized_keys on that remote host

when that is setup you will be able to run exactly that command on remote host via ssh using no password.

Answer 2

1) Create an ssh keypair "ssh-keygen -f /some/path/mykey" and don't give it a passphrase

2) Copy that to the authorized_keys file of the remote user "ssh-copy-id -i /some/path/mykey remoteuser@remotehost"

3) Create a cron job "echo '8 * * * * ssh -i /some/path/mykey remoteuser@remotehost /path/to/some/command' | crontab -"

4) Ideally edit ~remoteuser/.ssh/authorized_keys so the key is prefixed with command="/path/to/some/command"

If actually what you want to do is log in to the remote host as one user (eg remoteuser1) and then use sudo the run a command as another user (eg remoteuser2). You will need to set sudo on the remote host to allow the first user to run the command as the second user without supplying a password, somehthing like this ins /etc/sudoers -

remoteuser1 ALL = (remoteuser2) NOPASSWD: /path/to/some/command

Then have a cron job on the local host of "ssh -i /some/path/mykey remoteuser@remotehost sudo /path/to/some/command"