I originally asked this question stackEx, and realized it was a much better fit here.
I'm trying to automate the deployment of services on a cluster of hosts from a web-server. I've evoked the php exec function earlier to run simple scripts, and this was not an issue; however it seems the complexity of my current task is requiring further configuration.
I've swapped ssh keys between the hosts and web-server. This is the script tied into php exec as a button:
# store free memory text as variable a="/root/pl3bs/a.txt" b="/root/pl3bs/b.txt" c="/root/pl3bs/c.txt" amem=$(cat "$a") bmem=$(cat "$b") cmem=$(cat "$c") # run script on host which has most free memory if [ "$cmem" -gt "$amem" ] && [ "$cmem" -gt "$bmem" ] then ssh 'pl3bs@<ip_redacted>' 'bash -s' < /home/deploy.sh elif [ "$amem" -gt "$bmem" ] && [ "$amem" -gt "$cmem" ] then ssh 'pl3bs@<ip2_redacted>' 'bash -s' < /home/deploy.sh else [ "$bmem" -gt "$amem" ] && [ "$bmem" -gt "$cmem" ] ssh 'pl3bs@<ip3_redacted>' 'bash -s' < /home/deploy.sh fi
So I know this is run from the www-data user, and I know there are issues with permissions, and security risks when jacking with this user to run scripts. I'm trying to do this right. I copied the /root/.ssh directory to /var/www/.ssh directory I created, chown it to www-data, put 700 permissions on the folder, and 600 for the authorized_keys file. It's still not running my script from the php button.
If I run this in the shell with:
sudo -u www-data ./instance.sh
It asks for a password. I swapped keys from the hosts to the web-server, and vice-versa before copying the ones in /root/.ssh to /var/www/.ssh, so why would this still be happening? I know the www-data user is specially restricted for a reason, so am thinking this something else must be done? How do I get this script to run, without causing a security hole?
I've been obsessing over this for nearly 24hrs now, and need a solution. Please, even if you tell me to start from scratch and go it another way, help me out.