Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm working on an EC2 box and trying to SSH command another box.

The command works in command-line, even php -a interactive. However it does not work when running as apache. Example cmd:-

   system('ssh -i /home/me/keys/key.pem user@ip-xx-xxx-xxx-xxx-end.ip "ls"');

I've tried adding apache to wheel group, and gshadow on both boxes. I've also just tried chowning the pem file to apache. Nothing.

Yet the command response fine in the two other use cases outlines.

What's going on here? Anyone know?

share|improve this question
    
Did you try to run this command from the command line using the apache user? This should be the same as running it from php executed by apache. –  Khaled Nov 7 '11 at 20:47

5 Answers 5

You need to specify the user in the ssh command options:

system('ssh -i /home/me/keys/key.pem me@ip-xx-xxx-xxx-xxx-end.ip "ls"');

This probably still won't work unless apache has access to your key.pem file which would be a huge security vulnerability. I really suggest using some ssh library (like others have suggested) and setting up apache with it's own ssh keys, and set up the server it's connecting to with reduced permission access to that account.

share|improve this answer
    
That was a mistake of the write up here - I do actually have a user@ - thanks for the pickup tho. –  waxical Nov 8 '11 at 9:25

First; try to run it as the webserver user, for example:

sudo -u www-data <whatever_command>

Second; make sure you not only capture the result of the command you are executing, but the lines it throws back. You can do this in PHP with:

string exec ( string $command [, array &$output [, int &$return_var ]] )

http://www.php.net/manual/en/function.exec.php

Third: please do come back with a working answer.

share|improve this answer
    
Hi José - thanks for your thoughts. I have now logged in as apache and then run the command with system, which outputs all - tho I have tried with exec before. I have tried this at command line via php -a interactive shell - I now get to the point where it asks for passphrase. Still nothing in script tho. I will update here when I have finally resolved issues. –  waxical Nov 8 '11 at 9:27
    
If it's asking for a passphrase it sounds like the apache user can't read the .pem file or the .pem file is wrong for some reason. (Permissive file permissions are considered a critical error by ssh so don't chmod 777. chmod 600 and chown apache-user are more likely to work.) –  Ladadadada Nov 8 '11 at 16:28

you need to use php openssh library to properly run these commands, otherwise, it can compromise security of your system.

share|improve this answer
    
Can you give an example of how to do this and expand on how it can compromise security not to use this library ? –  Iain Nov 8 '11 at 11:04
1  
    
1  
Those aren't really examples of how using embedded commands can be harmful. If you don't let any unsanitized user input near your exec command, it's not really any more harmful then any other PHP function. –  devicenull Nov 13 '11 at 20:19

Use pecl extension http://php.net/manual/en/book.ssh2.php

share|improve this answer

My recommendation would be to use phpseclib, a pure PHP SSH implementation. eg.

<?php
include('Net/SSH2.php');

$key = new Crypt_RSA();
$key->loadKey(file_get_contents('/home/me/keys/key.pem'));

$ssh = new Net_SSH2('ip-xx-xxx-xxx-xxx-end.ip');
if (!$ssh->login('user', $key)) {
    exit('Login Failed');
}

echo $ssh->exec('ls');

//echo $ssh->read('username@username:~$');
//$ssh->write("ls -la\n");
//echo $ssh->read('username@username:~$');
?>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.