5

I was trying the Perfect Workflow, with Git, GitHub, and SSH, but it seems i can't run git pull. I've tried git status and it's fine.

When i git pull 2>&1 i get:

error: cannot open .git/FETCH_HEAD: Permission denied

I tried to chmod .git dir to 777 with no luck.

When i run whoami from the browser it shows me: apache

--- EDIT ---

I just did chown apache:apache -R .git and now i get:

Could not create directory '/.ssh'. Host key verification failed. fatal: The remote end hung up unexpectedly

6 Answers 6

6

Could not create directory '/.ssh'. Host key verification failed. fatal: The remote end hung up unexpectedly

Read and consider your error message. Host keys are stored in the ~/.ssh/known_hosts file. Your Apache user has "/" as its home directory, and it definitely doesn't and shouldn't have write access to the root.

I suggest that you create a user account for this... maybe gitpull-user or something. Make sure it has a usable home directory, even if it's somewhere atypical. Login as that user and create a shell script that accomplishes what you're trying to do as that user. Of course, you'll also have to copy your appropriate id_rsa key to the user's account, etc.

Configure sudo to launch that script by adding this line to /etc/sudoers

apache ALL = (gitpull-user) NOPASSWD: /path/to/script.sh`

and also if you're having "No TTY" issues:

Defaults:apache !requiretty

Change your PHP script to call sudo -u gitpull-user ./script.sh


It would be possible to change Apache's home directory to a "real" location and just drop the key in there, but that would expose a risk where your data would have to be owned by apache and the key could be read if the daemon were compromised. Establishing a second user provides a level of isolation.

4
  • Thanks for your help Jeff Ferland. Unfortunately i dont have the knowledge to do that. Appreciated the effort.
    – AFRC
    Feb 21, 2012 at 12:43
  • useradd gitpull-user; chown gitpull-user script; chmod 4755 script. Feb 21, 2012 at 12:55
  • Thanks again Jeff. I did that. But nothing happened.
    – AFRC
    Feb 21, 2012 at 14:06
  • I am having exactly the same problem but I am on nginx. A step by step approach should really help!
    – beNerd
    Dec 3, 2014 at 16:57
0

Run:

sudo -u apache ssh YOURGITHOST

Basically, the apache user doesn't know what the remote servers SSH host key is, and it can't prompt you to accept it. There's other ways to do this, but this is the one I remember best.

1
  • I run sudo -u apache ssh github.com Could not create directory '/.ssh'. The authenticity of host 'github.com (207.97.227.239)' can't be established. RSA key fingerprint is ##############################. Are you sure you want to continue connecting (yes/no)? yes Failed to add the host to the list of known hosts (/.ssh/known_hosts). Permission denied (publickey).
    – AFRC
    Feb 21, 2012 at 2:38
0

You seem to have two closely-related problems:

  1. The user apache is running as can't write to the normal location for its ~/.ssh directory (because on CentOS Apache's home directory is /, and obviously we don't want the web server just putting things wherever it wants in the filesystem).

  2. Github wants a public key to authenticate you.

There's a fix that should be able to handle both of these cases: git uses the GIT_SSH environment variable (if it's set) to determine what command to run as "ssh", so you just need to tweak that environment variable to tell SSH two things: Where to look for its known_hosts file, and what public key to use to authenticate with.

Add
export GIT_SSH="ssh -oUserKnownHostsFile=/some/path/to/known_hosts -i /some/path/to/private_key"
to your script and things should work OK (obviously substitute a path Apache can write to for the dummy paths in my example).

Note that you will have to connect to the remote host once as the Apache user to create and populate the known_hosts file. You can do that by running the script from the command line and dealing with the interactive prompt when it comes up. If you run the script a second time you should not have any interactive prompts do deal with.

0

I was trying to pull from a GIT repository using exec() in a webserver PHP script, too. The remote repository was checked out read-only under a different user.

My main problem was that when running the webserver PHP script the EXEC result variables from the PULL were completely empty - I just could tell that the PULL did not happen, no further error messages, nothing. A simple 'git help' did work, though.

What fixed the problem was the following:

First I make the webserveruser owner of the repository directory:

chown -R <webserveruser>:<webusergroup> <repodir>

Usually can't login to the webserver user, so I had assign a shell first:

usermod -s /bin/bash <webserveruser>

Login as webserver user:

su <webserveruser>

Then change to the repodirectory and do a manual pull :

cd <repodir>
git pull

Exit the webserver user and go back to root and disable the shell on the webserver user again:

exit
usermod -s /bin/false <webserveruser>

As strange as it sounds: After that the read-only PULL using the webserver script worked just fine.

0

I meet the same Question like yours. and i try to do below

  1. you should know the 'role' of http execute. Just like your 'apache'
  2. create your ssh key sudo -u apache ssh-keygen -t rsa and the path of the key will be show in the cmd screen.
  3. go to the path and cat id_rsa.pub, copy your key and post to the github or gitlab
  4. finally, because your server dont know the host of git server. So you should do below:
    sudo -u http ssh <git host> ,git host maybe github.com or gitlab.com
    Type 'yes' after you used the cmd. And you will find the server create a file named 'known_hosts' in '.ssh/'
  5. To try your php exec('git pull origin master'), it is ok.

--

0

If you're using https instead of ssh you can specify user/password directly in the request:

git clone:

$output = shell_exec ("git clone https://user:[email protected]:user/repo.git");

git pull:

$output = shell_exec("git pull https://user:[email protected]:user/repo.git");

sample php code

<?php

$outputs =  shell_exec('git pull https://user:[email protected]:user/repo.git master');
echo "<pre>$outputs</pre>";
?>

$outputs it will show the last commit result.

Then you add permission for your project folder

chown -R <webserveruser>:<webusergroup> <repodir>

Restart the apache server

sudo service apache2 restart 

it will work from the browser you can run the php file. the code will update

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .