Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was trying the Perfect Workflow, with Git, GitHub, and SSH, but it seems i can't run git pull. I've tried git status and it's fine.

When i git pull 2>&1 i get:

error: cannot open .git/FETCH_HEAD: Permission denied

I tried to chmod .git dir to 777 with no luck.

When i run whoami from the browser it shows me: apache

--- EDIT ---

I just did chown apache:apache -R .git and now i get:

Could not create directory '/.ssh'. Host key verification failed. fatal: The remote end hung up unexpectedly

share|improve this question

4 Answers 4

up vote 5 down vote accepted

Could not create directory '/.ssh'. Host key verification failed. fatal: The remote end hung up unexpectedly

Read and consider your error message. Host keys are stored in the ~/.ssh/known_hosts file. Your Apache user has "/" as its home directory, and it definitely doesn't and shouldn't have write access to the root.

I suggest that you create a user account for this... maybe gitpull-user or something. Make sure it has a usable home directory, even if it's somewhere atypical. Login as that user and create a shell script that accomplishes what you're trying to do as that user. Of course, you'll also have to copy your appropriate id_rsa key to the user's account, etc.

Configure sudo to launch that script by adding this line to /etc/sudoers

apache ALL = (gitpull-user) NOPASSWD: /path/to/script.sh`

and also if you're having "No TTY" issues:

Defaults:apache !requiretty

Change your PHP script to call sudo -u gitpull-user ./script.sh


It would be possible to change Apache's home directory to a "real" location and just drop the key in there, but that would expose a risk where your data would have to be owned by apache and the key could be read if the daemon were compromised. Establishing a second user provides a level of isolation.

share|improve this answer
    
Thanks for your help Jeff Ferland. Unfortunately i dont have the knowledge to do that. Appreciated the effort. –  AFRC Feb 21 '12 at 12:43
    
useradd gitpull-user; chown gitpull-user script; chmod 4755 script. –  Jeff Ferland Feb 21 '12 at 12:55
    
Thanks again Jeff. I did that. But nothing happened. –  AFRC Feb 21 '12 at 14:06
    
I am having exactly the same problem but I am on nginx. A step by step approach should really help! –  beNerd Dec 3 at 16:57

Run:

sudo -u apache ssh YOURGITHOST

Basically, the apache user doesn't know what the remote servers SSH host key is, and it can't prompt you to accept it. There's other ways to do this, but this is the one I remember best.

share|improve this answer
    
I run sudo -u apache ssh github.com Could not create directory '/.ssh'. The authenticity of host 'github.com (207.97.227.239)' can't be established. RSA key fingerprint is ##############################. Are you sure you want to continue connecting (yes/no)? yes Failed to add the host to the list of known hosts (/.ssh/known_hosts). Permission denied (publickey). –  AFRC Feb 21 '12 at 2:38

You seem to have two closely-related problems:

  1. The user apache is running as can't write to the normal location for its ~/.ssh directory (because on CentOS Apache's home directory is /, and obviously we don't want the web server just putting things wherever it wants in the filesystem).

  2. Github wants a public key to authenticate you.

There's a fix that should be able to handle both of these cases: git uses the GIT_SSH environment variable (if it's set) to determine what command to run as "ssh", so you just need to tweak that environment variable to tell SSH two things: Where to look for its known_hosts file, and what public key to use to authenticate with.

Add
export GIT_SSH="ssh -oUserKnownHostsFile=/some/path/to/known_hosts -i /some/path/to/private_key"
to your script and things should work OK (obviously substitute a path Apache can write to for the dummy paths in my example).

Note that you will have to connect to the remote host once as the Apache user to create and populate the known_hosts file. You can do that by running the script from the command line and dealing with the interactive prompt when it comes up. If you run the script a second time you should not have any interactive prompts do deal with.

share|improve this answer

I was trying to pull from a GIT repository using exec() in a webserver PHP script, too. The remote repository was checked out read-only under a different user.

My main problem was that when running the webserver PHP script the EXEC result variables from the PULL were completely empty - I just could tell that the PULL did not happen, no further error messages, nothing. A simple 'git help' did work, though.

What fixed the problem was the following:

First I make the webserveruser owner of the repository directory:

chown -R <webserveruser>:<webusergroup> <repodir>

Usually can't login to the webserver user, so I had assign a shell first:

usermod -s /bin/bash <webserveruser>

Login as webserver user:

su <webserveruser>

Then change to the repodirectory and do a manual pull :

cd <repodir>
git pull

Exit the webserver user and go back to root and disable the shell on the webserver user again:

exit
usermod -s /bin/false <webserveruser>

As strange as it sounds: After that the read-only PULL using the webserver script worked just fine.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.