Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to set up a one command way to move website code from a dev machine up into my Ubuntu EC2 instance and have it be copied straight into the /var/www/mywebsite folder where nginx expects to find web sites on that box.

These Ubuntu AMIs come with a default ubuntu user. I can rsync a folder without any trouble from the dev machine to the EC2 instance's /home/ubuntu/ folder:

rsync -avL --progress -e "ssh -i /home/me/myhosts.pem" source-folder ubuntu@ec2-xx-xxx-xxx-xxx.compute-1.amazonaws.com:~/code

but when I try to rsync that same folder to /var/www as root:

rsync -avL --progress -e "ssh -i /home/me/myhosts.pem" source-folder root@ec2-xx-xxx-xxx-xxx.compute-1.amazonaws.com:/var/www/

I get the following error:

protocol version mismatch -- is your shell clean?
(see the rsync man page for an explanation)
rsync error: protocol incompatibility (code 2) at compat.c(174) [sender=3.0.9]

I'm not exactly clear on why this is happening. I noticed that I've not been able to ssh in as root as I get the following message:

Please login as the user "ubuntu" rather than the user "root".
Connection to ec2[...] closed.

which might explain the behavior above. sshd_config does have "PermitRootLogin" yes though, but I guess that's blocked somewhere else.

I guess one option would be to alter the permissions of the /var/www folder (right now it's 755 root root) and allow ubuntu to copy files there without having to elevate to root every time. I'm however not sure if that's a good idea security-wise and if that's the right solution here, so I'd appreciate advice.

Thank you!

share|improve this question

2 Answers 2

up vote 2 down vote accepted

You can also start rsync using sudo on the remote machine to run it with root privileges. The option you can use for this is --rsync-path:

rsync -avL --progress -e "ssh -i /home/me/myhosts.pem" --rsync-path="sudo rsync" source-folder ubuntu@ec2-xx-xxx-xxx-xxx.compute-1.amazonaws.com:/var/www/
share|improve this answer
    
This seems to have worked, thank you! What's the secret sauce here? From what I can understand, I'm ssh-ing in as the authorized ubuntu user, and then instead of calling rsync, I'm elevating myself to root first and then running the command. Is that more or less what's happening? –  Alexandr Kurilin May 17 '13 at 1:22
1  
Yes. You're running sudo rsync instead of just rsync on the remote machine, therefore it's running with root privileges. –  etagenklo May 17 '13 at 13:17

What is you rsync version on client and server? run

     rsync --version

It should be the same on both client and server side.

Try increasing log verbosity on SSH Server (Loglevel debug in sshd_config and /etc/init.d/ssh restart) and assure the connection is not related to a single user (User clause should be empty or contain root if you want to log in as root - which is always a bad idea, except for debugging). Then, look for errors in /var/log/auth.log.

share|improve this answer
    
Hello philippe, thank you for the suggestions. I double-checked the versions and they're 3.0.9 protocol version 30 on both client and server, so that should be ok. Now, I've increased the ssh log level and recorded what happens as per your instructions. I have the log pastebin here: pastebin.com/Uhwqp1qF Based on what I can see, ssh as root works fine up until the following command: Forced command (key option) 'echo 'Please login as the user "ubuntu" rather than the user "root".';echo;sleep 10' I don't know where that is set from, but it seems like sshing in as root is currently not allowed –  Alexandr Kurilin May 17 '13 at 1:13
1  
mmmh is there anything before the tag ssh-rsa or ssh-dsa in your first key on /root/.ssh/authorized_keys? It looks like there is an instruction such as 'command="echo 'Please login as the user "ubuntu" rather than the user "root".';echo;sleep 10'" ? I have the feeling that your connection goes well, you use this ssh key and it lets you connect in the server, but this command forces you to execute it and disconnect once executed. This is usually a good way to do to force root connection to perform one and only one action, but does not fit your use case. –  philippe May 17 '13 at 9:01
    
I think you got to the bottom of it. I actually just found a post that talks about this very issue, seems like the issue is exactly where you pointed at: b.sricola.com/post/15820813255/… Do you know if there's a good reason why they allow "PermitRootLogin yes" in sshd_config but then use this other command to prevent that anyway? This is on the default ec2 ubuntu AMIs. –  Alexandr Kurilin May 17 '13 at 9:09
1  
I have no idea why they configure their SSH server like this. This is not recommended to let root connect without password, and as a matter of fact, to let root connect at all. For automatic tasks as yours which requires root connection for a particular task, I would recommend PermitRootLogin forced-command-only to only let the command specified by the command tag in the authorized_keys run (and nothing more). –  philippe May 17 '13 at 12:33
    
The one explanation I heard is that it's a way for them to educate users not to ssh in as root. Not sure how true that is in practice. –  Alexandr Kurilin May 17 '13 at 21:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.