0

I'm working on an EC2 box and trying to SSH command another box.

The command works in command-line, even php -a interactive. However it does not work when running as apache. Example cmd:-

   system('ssh -i /home/me/keys/key.pem user@ip-xx-xxx-xxx-xxx-end.ip "ls"');

I've tried adding apache to wheel group, and gshadow on both boxes. I've also just tried chowning the pem file to apache. Nothing.

Yet the command response fine in the two other use cases outlines.

What's going on here? Anyone know?

  • Did you try to run this command from the command line using the apache user? This should be the same as running it from php executed by apache. – Khaled Nov 7 '11 at 20:47
2

First; try to run it as the webserver user, for example:

sudo -u www-data <whatever_command>

Second; make sure you not only capture the result of the command you are executing, but the lines it throws back. You can do this in PHP with:

string exec ( string $command [, array &$output [, int &$return_var ]] )

http://www.php.net/manual/en/function.exec.php

Third: please do come back with a working answer.

  • Hi José - thanks for your thoughts. I have now logged in as apache and then run the command with system, which outputs all - tho I have tried with exec before. I have tried this at command line via php -a interactive shell - I now get to the point where it asks for passphrase. Still nothing in script tho. I will update here when I have finally resolved issues. – waxical Nov 8 '11 at 9:27
  • If it's asking for a passphrase it sounds like the apache user can't read the .pem file or the .pem file is wrong for some reason. (Permissive file permissions are considered a critical error by ssh so don't chmod 777. chmod 600 and chown apache-user are more likely to work.) – Ladadadada Nov 8 '11 at 16:28
2

You need to specify the user in the ssh command options:

system('ssh -i /home/me/keys/key.pem me@ip-xx-xxx-xxx-xxx-end.ip "ls"');

This probably still won't work unless apache has access to your key.pem file which would be a huge security vulnerability. I really suggest using some ssh library (like others have suggested) and setting up apache with it's own ssh keys, and set up the server it's connecting to with reduced permission access to that account.

  • That was a mistake of the write up here - I do actually have a user@ - thanks for the pickup tho. – waxical Nov 8 '11 at 9:25
1

you need to use php openssh library to properly run these commands, otherwise, it can compromise security of your system.

1

My recommendation would be to use phpseclib, a pure PHP SSH implementation. eg.

<?php
include('Net/SSH2.php');

$key = new Crypt_RSA();
$key->loadKey(file_get_contents('/home/me/keys/key.pem'));

$ssh = new Net_SSH2('ip-xx-xxx-xxx-xxx-end.ip');
if (!$ssh->login('user', $key)) {
    exit('Login Failed');
}

echo $ssh->exec('ls');

//echo $ssh->read('username@username:~$');
//$ssh->write("ls -la\n");
//echo $ssh->read('username@username:~$');
?>
0

Use pecl extension http://php.net/manual/en/book.ssh2.php

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.