2

I'm trying the following command:

ssh -A user@server 'bash -s' < mylocalscript.sh

But get the annoying sudo: no tty present and no askpass program specified when the script reaches a sudo. According to man ssh, -A is supposed to forward local authentication, so it should be able to use sudo on the remote server..

What am I doing wrong/not understanding..?

Improve this question

2 Answers 2

Reset to default
2

SSH authentication and sudo authentication are two different sets of credentials. The -A option to the ssh command applies to SSH only. It provides the ability to forward your credentials so you can ssh from server to another system using your local SSH key.

Unless you have sudo rules allowing you to run commands with no password, it will always need to prompt for your password, either from your shell's terminal or using an askpass program, if so configured. An askpass program is a (typically graphical) helper program that simply prompts for a password securely. To authenticate with sudo remotely, you will have to do one of the two things it is requesting:

  • Ensure you have a tty so sudo can securely prompt for your password on the server. This is as easy as logging in with ssh -t.

  • Tell sudo to prompt for your password using an askpass program with the -A option on sudo (not to be confused with the -A option for ssh!). This can be done in your script, for example, with something like:

    export SUDO_ASKPASS=/usr/lib/openssh/gnome-ssh-askpass
sudo -A ...

Note that since you are piping your shell script to the standard input stream of the SSH connection, sudo will be unable to securely prompt for a password. If sending the script over the SSH standard input like this is a requirement (instead of just copying the script to the server), then the first option will not work. You will have to either use an askpass helper program or configure the required sudo rules to use NOPASSWD, if that is an option.

Improve this answer
6
  • Option 1 doesn't seem to work, I get Pseudo-terminal will not be allocated because stdin is not a terminal.
    – knownasilya
    May 5, 2014 at 19:09
  • Ah, good catch, thanks for correcting. That's because you are piping the script to standard input, so sudo cannot prompt you for your password over the same channel. So basically you will have to use the askpass helper, or change your sudo permissions to use NOPASSWD.
    – Michael Miller
    May 5, 2014 at 19:14
  • I had the user in a group www-data and that group didn't have NOPASSWD but the user did, and this prevented it from working. Seems like both need it, or maybe just the group?
    – knownasilya
    May 5, 2014 at 19:31
  • 1
    @Knownasilya, not when I tested it. If a user matches sudo rules for the user name and the group name, then any of them should work. If you ssh user@server sudo -l it should list all rules that match. Maybe missing or extra punctuation in /etc/sudoers? That trips me up every now and then.
    – Michael Miller
    May 5, 2014 at 19:50
  • Don't think so, I used sudo visudo which catches errors..
    – knownasilya
    May 6, 2014 at 15:51
1

Your premise that -A will help sudo is wrong unfortunately. It merely forwards the ssh-agent. You will have to run askpass like the warning suggests.

Also note that bash -c is not needed. You can simple pipe in your script with ssh server < mylocalscript.sh

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .