scp to copy file to remote server fails because of permissions

Question

I think my fundamental problem is that I don't fully understand how ssh / scp works. But I don't what to google to try to read up on my question.

Problem Description

I have created a bash script on serverA. It tries to scp a file from serverA to serverB. This script will be scheduled as a cron job.

To test whether this script will work, I just tried to manually scp the file from serverA to serverB. But I'm getting a "Permission denied" error message on serverA.

I logged into serverA in the first place like this:

mycomputer#> ssh [email protected]

Questions:

Is the manual scp test even a good idea? Because I'm logging in using my key into serverA but ultimately, it's the cron job that's going to trigger to scp command.

How do I know under what user ID / keys the cron job will attempt the copy?

What should I google to better understand how this all works?

Thanks.

Answer 1

If you want to automate something like this you will need to setup public / private keys on either side and then configure ssh for authorized keys in the direction you want to copy. Assuming you are using OpenSSh do the following on both systems:
ssh-keygen -t dsa
cd ~/.ssh
cp id_dsa identity
cp id_dsa.pub authorized_keys
cp id_dsa.pub systemname_id_dsa.pub

Now you will need to copy the last file from the source system to the target system's ~/.ssh directory and then run the following command:
cat systemname_id_dsa.pub >> authorized_keys

You should now be able to ssh / scp from source to target without a password for this user. I would suggest not doing this as root, but as another user as it opens up possible security issues when done as root.

Answer 2

for better understanding, I would recommend you to look into these two components from OpenSSH suite (you can do it by man ssh-keygen and/or man ssh-copy-id):

• SSH-KEYGEN(1) — authentication key generation, management and conversion
• SSH-COPY-ID(1) — use locally available keys to authorise logins on a remote machine

example (how to make key pair and copy it over to remote host):

SSH-KEYGEN(1):

$ ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/X/.ssh/id_rsa): 
Created directory '/X/.ssh'.
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /X/.ssh/id_rsa.
Your public key has been saved in /X/.ssh/id_rsa.pub.
The key fingerprint is:
e0:cd:fd:18:45:66:0d:11:a0:08:75:6a:f3:1a:6c:45 X@Z
The key's randomart image is:
+--[ RSA 2048]----+
|    ... E ..B=   |
|     . = . +  .  |
|      * o   .    |
|     + B . .     |
|      = S o      |
|     . o   +     |
|      .   . .    |
|                 |
|                 |
+-----------------+
$

&

SSH-COPY-ID(1):

$ ssh-copy-id root@Y
The authenticity of host 'Y (Z.Z.Z.Z)' can't be established.
RSA key fingerprint is 5e:8e:ad:71:77:6a:c4:16:e6:0e:34:f8:92:b2:ce:9f.
Are you sure you want to continue connecting (yes/no)? yes
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@Y's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@Y'"
and check to make sure that only the key(s) you wanted were added.

$

You then will be able to use scp to copy without password prompt...

Is the manual scp test even a good idea? Because I'm logging in using my key into serverA but ultimately, it's the cron job that's going to trigger to scp command.

before scheduling to cron, I'd do manual test as this way you know what to expect without waiting for scheduled time.

How do I know under what user ID / keys the cron job will attempt the copy?

crond usually runs under root, but to verify you can use following:

# ps aux | grep crond | grep -v grep
root      2696  0.0  0.0 126336  1712 ?        Ss   May13   0:01 /usr/sbin/crond -n
# 

Answer 3

To copy from Server A to Server B using scp you need to:

1) Pick a user on Server B (userB) who should "receive" the files. This user will require write permissions in the directory that files will be copied into.

2) Create a public/private key pair for that user.

3) Place the public key at /.ssh/allowedkeys on Server B.

4) Pick a user on Server A who will send the files. This user will require read permissions on the files to be sent.

5) Place the private key at /.ssh/userB on Server A

6) Write a script to copy the desired files. The copy will be something like scp -i ~/.ssh/userB somefiles [email protected]:/somedirectory/

7) Log on to Server A as userA and run crontab -e to edit userA's crontab add the script to the crontab with desired settings.

That should get you there.