0

I have created a program using perl CGI where i am calling my server script which is at remote location. For that i have used OpenSSH. But when i run this script from my terminal it works fine my remote machine script also runs properly. But when i do this from Browser it doesn't works. I have used below script.

#!/usr/bin/perl
use warnings;
use strict;
use CGI;
use Net::OpenSSH;
use warnings;
our $cgi = new CGI;

use Net::OpenSSH;
my %opts = (
    user        => "UNAME",
    #password    => "MYPASSWORD", 
    strict_mode => 0,         
);
my $ssh = Net::OpenSSH->new("MY SERVER_IP",%opts,master_opts => [-i => "MY KEY FILE"], async => 1);
$ssh->system("/root/test.sh") or    
    die "remote command failed: " . $ssh->error;

Below are the logs from apache error logs

[Fri Jun 27 12:11:57 2014] [error] [client localhost] Permission denied (publickey,gssapi-keyex,gssapi-with-mic).\r, referer: http://X.X.X.X/cgi-bin1/test.cgi

  • What is value of "MY KEY FILE"? – cuonglm Jun 27 '14 at 8:31
  • Basically in MY KEY FILE i have put my private key file path i.e – Huzefa Jun 27 '14 at 8:34
  • my $ssh = Net::OpenSSH->new("MY SERVER_IP",%opts,master_opts => [-i => "/home/myfile.pem"], async => 1); $ssh->system("/root/test.sh") – Huzefa Jun 27 '14 at 8:34
  • What is output of ls -l /home/myfile.pem? – cuonglm Jun 27 '14 at 8:43
  • -rwx------ 1 huzefa huzefa 1692 Nov 19 2013 myfile.pem – Huzefa Jun 27 '14 at 8:52
3

CGI-scripts are usually run as the same user as the web server is run under - often the username wwwdata, or www. Since your key file is restricted your own username, huzefa, the webserver cannot access it.

If you were to allow the webserver user to use your own ssh key, then it would be possible for someone who found a security hole in your webserver to use your key and then login to any server that you have access to with that key. You probably don't want this.

There are a few ways to get around this without opening a huge security hole. The easiest is to simply set up a separate ssh key for this particular use:

  1. Generate a new ssh key and place it in a directory that the web server user can access
  2. Copy the public part of the key to the authorized_keys file on the server.
  3. Edit the authorized_keys file so that the public key used by the web server can only be used to run that one script. For extra security, limit it to only allow connections from the IP address of your server. It should look something like this:
from="10.1.2.3",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="/root/test.sh" ssh-dss AA.....
  • Super. I didn't know you could limit commands in authorized_keys. That makes it very secure. Works like a charm. Thanks. – dlink Nov 28 '17 at 21:00
1

Web server process is owned by apache user not as root.

  1. Make sure that apache user have password less access to other server

  2. SELinux should be disabled

Refer : http://wccandlinux.blogspot.in/2016/07/how-to-run-ssh-command-from-apache.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.