7

I have a headless server running Ubuntu 12.04.4 that needs to come back up after a reboot without user intervention. There is an existing manual process that involves looking at files on a remote server over sftp and manipulating certain ones. The auth for the sftp site uses a username and password. I want to automate this process by removing the manual step of getting into the sftp server by mounting the remote volume directly on the server that needs the files.

Note that I do not have a ssh identity file because key based auth is not being used. I cannot change the remote end to use key auth; I need to use the existing username and password. Most of the guides I've found out there only deal with using a key based identity file.

Current fstab config:

sshfs#[email protected]:/SecureFTP /my/localpath fuse allow_other,uid=root,gid=clientfiles,umask=0770

When mounting interactively, it prompts for the password. I need the server to be able to recover from a reboot without having someone there to babysit and type the password in, so it needs to work without any prompting. I don't know how to get the password in aside from the prompt. Ideally, I could specify a credential file with the username and password like I can with the credentials=<file name> cifs option.

I've tried credentials= and password= as mount options but they don't seem to be defined for sshfs; I get fuse: unknown option.

There IS a password_stdin option for sshfs but I'm not sure how that applies in fstab.

6
  • Make a ssh key. This has nothing to do with the server. Make a key on the client and then transfer the key to the server with ssh-copyid . Then use a fstab entry with the key ;)
    – Panther
    May 28, 2014 at 20:27
  • 1
    @bodhi.zazen Can't. "Remote execution access has been disabled by the system administrator" May 28, 2014 at 20:38
  • Why not? I do not think sshfs allows password authentication in fstab.
    – Panther
    May 28, 2014 at 20:44
  • The remote end may not even be a unixy box with full ssh. It's not under my control. ssh-copy-id fails without remote execution enabled. I asked this question to find some way of making this work... it seems like an oversight if there is no way to do it. May 28, 2014 at 20:52
  • Contact the owner of the server (remote) box and have a key made for this purpose.
    – Panther
    May 28, 2014 at 20:58

3 Answers 3

3
  • In this example I implied that we work as root. If you don't, apply sudo su or sudo when needed.
  • Your system may use different init system than Systemd, but Cron is pretty universal.

You can simply use /etc/fstab to pre-define your mount options and whatnot.

Example:

USERNAME@HOSTNAME_OR_IP:/REMOTE/DIRECTORY /LOCAL/MOUNTPOINT fuse.sshfs  defaults,password_stdin,_netdev 0 0

Keep in mind default mount options are far from perfect.
For example: reconnect is important. see: https://github.com/libfuse/sshfs/issues/101

An example with these options (taken from the Github issue):

sshfs#[email protected]:/content/ /mnt/srv fuse   password_stdin,defaults,user,allow_other,reconnect,delay_connect,ConnectTimeout=5,ServerAliveInterval=5,IdentityFile=/root/.ssh/id_rsa_storage 0 0

Once that's done, you need a simple script with this sole content, such as:

#!/bin/bash
echo "passwordgoeshere" | mount /mnt/srv

Let's save it under your root user, so an example: /root/mount_sshfs.sh
Now you need to make it executable: chmod +x /root/mount_sshfs.sh

Timeout waiting for prompt error: You should try to run the script once to see if it works. If it doesn't exit and you eventually get a Timeout waiting for prompt error, try to ssh into the remote host as root. If you never did that before, sshfs will prompt to add the host to the known_hosts file and that's when the script is waiting for a response until the timeout is reached.

Now all you need is just cron or systemd to execute this on mount.
With cron, a simple entry like this works:
@reboot /root/mount_sshfs.sh

With systemd:

  1. You have to create the script. See just above.

  2. You have to create a new Systemd service script.
    An example would be: /etc/systemd/system/mount_network.sh

  3. The contents of the file:

    [Unit]
    Wants=network-online.target
    After=network-online.target
    
    [Service]
    ExecStart=/root/mount_sshfs.sh
    
    [Install]
    WantedBy=default.target
    

Notes:

  • I did not test the systemd method as I try not to rely on it as much as possible. It's a personal preference.
  • With cron, you may need to add a "sleep" to the script, so it doesn't try to run the script "too early", i.e.: before internet/network comes up.

Source: https://linuxconfig.org/how-to-automatically-execute-shell-script-at-startup-boot-on-systemd-linux

2
  • that's so ugly that I am almost creating an empty password
    – imbr
    Jun 16, 2022 at 18:30
  • @iambr Trust me I tried for days and days looking for a more elegant solution. There is nothing. Your best bet is key auth. But if it cannot be done, this is the (ugly) way.
    – Apache
    Jul 4, 2022 at 10:11
2

Yes, you can do this in fstab with sshpass.

The parameter would look like such, and simply executes sshpass -f /root/sftp.pass ssh when connecting: ssh_command=sshpass\040-f\040/root/sftp.pass\040ssh

For example, to connect as username with password secret to a server sftp.example.com on port 2222 your fstab entry could look something like this:

sshfs#[email protected]:/ /mnt/sftp fuse ssh_command=sshpass\040-f\040/root/sftp.pass\040ssh,_netdev,rw,port=2222,allow_other,reconnect,user,sshfs_debug,kernel_cache,auto_cache,uid=0,gid=0 0 0

You will need a file /root/sftp.pass with the password in it:

secret

And you should ideally create a systemd unit that will make sure this mount reconnects, refer to the other answer for specifics, but you can script something like this running every minute or two:

/bin/mountpoint -q /mnt/pwprodshare || /bin/mount /mnt/pwprodshare >> /dev/null
1

Here's how to do this assuming that

  • only a single local user (USER, uid 1000) needs to access the mount on REMOTE
  • your ssh key is unlocked by your login keyring
  • you want a systemd automount
$ cat /etc/ssh/ssh_config.d/agent.conf
Host REMOTE
    IdentityAgent /run/user/1000/keyring/ssh

fstab row:

USER@REMOTE:/remote/path /mount/point fuse.sshfs x-systemd.automount,user,idmap=user,transform_symlinks,identityfile=/home/USER/.ssh/id_rsa,allow_other,default_permissions,uid=1000,gid=100 0 0

Remember to mount (and unmount) once manually first using sudo sshfs with corresponding options.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .