7

I am creating a script which runs a series of command that would download a website to a machine and sets up everything.

So most of the commands require root access. For example adding a vhost in /etc/apache2/sites-available, enabling it, restarting apache, etc...

So in order to do that, I need to run the script with sudo.

sudo ./install-website.sh

The website is located on a server with a git repository which is setup with a password-less SSH access. But that only works for the user dan since the keys are in my home folder and not in the root's home folder.

So when it reaches this part:

git clone [email protected]:git-repo $PATH_TO_INSTALLATION

Since I started the script with sudo, the user that is trying to initiate the git command is root. So the host keeps asking for the host's user's password.

I have tried the following command:

sudo -u $SUDO_USER git clone [email protected]:git-repo $PATH_TO_INSTALLATION

But it was still asking for the host's user's password.

Is it possible to tell sudo to use the $SUDO_USER's home path?

Most of the stuff are variables, and have to be variables as I will run this on more than 1 machine.

2
  • I guessed you try that: git clone [email protected]:.... why does it not work?
    – Huygens
    Mar 14, 2013 at 11:50
  • Preferred way would be to add root id_rsa.pub key to authorized_keys on host.com system. So in case the one of clonning machines need to have access revoked, just remove it's key.
    – PeterM
    Oct 20, 2017 at 11:31

3 Answers 3

4

Alternative 1 - Configuring sudo

Sudo is configure in the sudoers file which you should only edit through the visudo command.

This configuration file can override certain environment variables with the option env_reset. How to proceed:

visudo

Then find a line that states:

Defaults env_reset 

and add after it (e.g. example with the HOME environement):

Defaults env_keep = "HOME"

This example is for every sudo configuration you may have. You can also specify it on a per user/group basis. See sudoers manual page.

Alternative 2 - configuring SSH

You can use the configuration file of SSH to specify users, key to use, etc. I have explain that at SuperUser.

Proposed solution (but you will have to correct the missing and assumed bits), edit the file /root/.ssh/config and set its permission chmod 0600 /root/.ssh/config:

Host host.com
  User dan
  IdentityFile /home/dan/.ssh/id_rsa

Then as root, you can do the next command and it will use the proper SSH identifications:

git clone host.com:git-repo $PATH_TO_INSTALLATION
5
  • I'd prefer not to modify system configurations to make the script work, as I want to run on multiple machines and prefer not to configure all of them.
    – Dan
    Mar 14, 2013 at 13:00
  • Then you should be able to use alternative 2, there is no default .ssh/config file, so you can ship one with your script or create one from your script. You can see that in this file you can explicitly specify where you stored your generated ssh key, no need to have it in a default location.
    – Huygens
    Mar 14, 2013 at 13:08
  • I've been trying this solution for a while and trying to fix anything that might be wrong. But I keep getting the following error: /root/.ssh/config: line 3: Bad configuration option: IdentifyFile
    – Dan
    Mar 14, 2013 at 14:21
  • You have a typo it is not IdentifyFile but IdentityFile :-)
    – Huygens
    Mar 14, 2013 at 14:23
  • I think it's time to have my eyes checked ! Thanks it works
    – Dan
    Mar 14, 2013 at 14:26
3

Since the script is running as root, it can su straight to the unpriviliged user. Roots don't need to sudo, sudo is for lusers ;-).

Assuming the unprivileged user is dan, and $PATH_TO_INSTALLATION is set in the surrounding script:

su -lc "git clone [email protected]:git-repo $PATH_TO_INSTALLATION" dan

Note that $PATH_TO_INSTALLATION must be writable by dan.

6
  • This also keeps asking me for the host's user's password
    – Dan
    Mar 14, 2013 at 11:02
  • @Dan But not when you execute this as dan? Note the -l argument to su, to make sure you get a login shell, in dan's home.
    – zwets
    Mar 14, 2013 at 11:32
  • Yes, I've tried it as it is. I even tried the following command thinking maybe it might be a git issue. su -lc "ssh [email protected]" dan. It also asked me for a password.
    – Dan
    Mar 14, 2013 at 11:41
  • And when you login to a console (not the GUI), as dan, after a fresh restart (so no ssh-agent is caching anything), and you do "ssh [email protected]", you are not asked for a password?
    – zwets
    Mar 14, 2013 at 11:47
  • I assume you have a passwordless private key file in .ssh, correct? Have you tried using the -i argument to ssh, to explicitly tell it which private key file it should use?
    – zwets
    Mar 14, 2013 at 11:50
0

When I generated my ssh key a long time ago with ssh-keygen, I didn't choose the default path ~/.ssh/id_rsa. Thanks to zwets' comment, I remmebered that. I changed my key, and put it in ~/.ssh/id_rsa.

Now both of the commands work:

  1. With sudo

    sudo -u $SUDO_USER git clone [email protected]:git-repo $PATH_TO_INSTALLATION
    
  2. As suggested in zwets' answer

    su -lc "git clone [email protected]:git-repo $PATH_TO_INSTALLATION" $SUDO_USER
    

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .