1

I regularly have to deploy stuff via scp. The problem is that the user on the remote machine (e.g. tomcat) does not match the user i am logging in with (e.g. mylogin). And almost always I cannot login directly with the remote user (disabled from the admin)

Assume the following: I want to deploy a file into tomcats' webapps folder but can do this only via 'sudo -U tomcat' on the remote machine before.

At the moment I am doing sth. like this:

scp file.war [email protected]:/home/mylogin/tmp/
ssh [email protected] 'sudo -U tomcat cp /home/mylogin/tmp/file.war /tomcat/webapps/'

Is there a better solution without the temporary folder? I mean, is it possible with only one copying with a sudo "in-between"? Can this be done with portforwarding?

This question is related to this

2 Answers 2

0

Have your admin set up a user for SFTP-only access (this will not enable you to use SSH by "pushing a new config", whatever that means), and install your key for you, to a user in the same Unix group as tomcat, and have the tomcat user's directory made g+w. Then you would do something like

$ scp myfile upload@remotehost:~tomcat/

This is what the Unix group system is for, and this is what everyone did before the boneheads at Red Hat decided for some unknown reason that each user should have their own group.

3

Add your public key to the authorized_keys file of the tomcat user. This will allow you to ssh as tomcat:

scp file.war [email protected]:/tomcat/webapps/
4
  • Hi Cakemox, I have a similar scenario, in which I am downloading via scp from a Linux DB Server, I have added the SSH Keys to the appropriate directories on the host db box, but now anyone from that specific client, can SSH as root to that machine. Is it possible that I can allow root scp access no password but disallow any ssh root logins without password. - this is a internal virtual machine but still disabling root without password apart from scp would be desirable - thanks.
    – Mutahir
    Nov 3, 2010 at 12:13
  • Hi rihatum. It is possible to set up scp-only access or sftp-only access, but you run the risk of someone re-enabling ssh access by simply pushing new configs to re-allow ssh access. It would be safer to scp as a normal user, but set the permissions to allow that user to write to the files and/or directories as needed. I'm not sure root scp-only access can be guaranteed, maybe someone else has some ideas. I wouldn't recommend it, though.
    – Cakemox
    Nov 3, 2010 at 12:22
  • in my case this is not possible because tomcat (and similar root) cannot login into the remote machine - as I said this is disabled from the admin - even if I would add my key!
    – Karussell
    Nov 3, 2010 at 12:31
  • maybe there is a hack with port forwarding or pipeing?
    – Karussell
    Nov 3, 2010 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .