7

I am creating a script which runs a series of command that would download a website to a machine and sets up everything.

So most of the commands require root access. For example adding a vhost in /etc/apache2/sites-available, enabling it, restarting apache, etc...

So in order to do that, I need to run the script with sudo.

sudo ./install-website.sh

The website is located on a server with a git repository which is setup with a password-less SSH access. But that only works for the user dan since the keys are in my home folder and not in the root's home folder.

So when it reaches this part:

git clone user@host.com:git-repo $PATH_TO_INSTALLATION

Since I started the script with sudo, the user that is trying to initiate the git command is root. So the host keeps asking for the host's user's password.

I have tried the following command:

sudo -u $SUDO_USER git clone user@host.com:git-repo $PATH_TO_INSTALLATION

But it was still asking for the host's user's password.

Is it possible to tell sudo to use the $SUDO_USER's home path?

Most of the stuff are variables, and have to be variables as I will run this on more than 1 machine.

  • I guessed you try that: git clone dan@host.com:.... why does it not work? – Huygens Mar 14 '13 at 11:50
  • Preferred way would be to add root id_rsa.pub key to authorized_keys on host.com system. So in case the one of clonning machines need to have access revoked, just remove it's key. – PeterM Oct 20 '17 at 11:31
4

Alternative 1 - Configuring sudo

Sudo is configure in the sudoers file which you should only edit through the visudo command.

This configuration file can override certain environment variables with the option env_reset. How to proceed:

visudo

Then find a line that states:

Defaults env_reset 

and add after it (e.g. example with the HOME environement):

Defaults env_keep = "HOME"

This example is for every sudo configuration you may have. You can also specify it on a per user/group basis. See sudoers manual page.

Alternative 2 - configuring SSH

You can use the configuration file of SSH to specify users, key to use, etc. I have explain that at SuperUser.

Proposed solution (but you will have to correct the missing and assumed bits), edit the file /root/.ssh/config and set its permission chmod 0600 /root/.ssh/config:

Host host.com
  User dan
  IdentityFile /home/dan/.ssh/id_rsa

Then as root, you can do the next command and it will use the proper SSH identifications:

git clone host.com:git-repo $PATH_TO_INSTALLATION
  • I'd prefer not to modify system configurations to make the script work, as I want to run on multiple machines and prefer not to configure all of them. – Dan Mar 14 '13 at 13:00
  • Then you should be able to use alternative 2, there is no default .ssh/config file, so you can ship one with your script or create one from your script. You can see that in this file you can explicitly specify where you stored your generated ssh key, no need to have it in a default location. – Huygens Mar 14 '13 at 13:08
  • I've been trying this solution for a while and trying to fix anything that might be wrong. But I keep getting the following error: /root/.ssh/config: line 3: Bad configuration option: IdentifyFile – Dan Mar 14 '13 at 14:21
  • You have a typo it is not IdentifyFile but IdentityFile :-) – Huygens Mar 14 '13 at 14:23
  • I think it's time to have my eyes checked ! Thanks it works – Dan Mar 14 '13 at 14:26
3

Since the script is running as root, it can su straight to the unpriviliged user. Roots don't need to sudo, sudo is for lusers ;-).

Assuming the unprivileged user is dan, and $PATH_TO_INSTALLATION is set in the surrounding script:

su -lc "git clone user@host.com:git-repo $PATH_TO_INSTALLATION" dan

Note that $PATH_TO_INSTALLATION must be writable by dan.

  • This also keeps asking me for the host's user's password – Dan Mar 14 '13 at 11:02
  • @Dan But not when you execute this as dan? Note the -l argument to su, to make sure you get a login shell, in dan's home. – zwets Mar 14 '13 at 11:32
  • Yes, I've tried it as it is. I even tried the following command thinking maybe it might be a git issue. su -lc "ssh user@host.com" dan. It also asked me for a password. – Dan Mar 14 '13 at 11:41
  • And when you login to a console (not the GUI), as dan, after a fresh restart (so no ssh-agent is caching anything), and you do "ssh user@host.com", you are not asked for a password? – zwets Mar 14 '13 at 11:47
  • I assume you have a passwordless private key file in .ssh, correct? Have you tried using the -i argument to ssh, to explicitly tell it which private key file it should use? – zwets Mar 14 '13 at 11:50
0

When I generated my ssh key a long time ago with ssh-keygen, I didn't choose the default path ~/.ssh/id_rsa. Thanks to zwets' comment, I remmebered that. I changed my key, and put it in ~/.ssh/id_rsa.

Now both of the commands work:

  1. With sudo

    sudo -u $SUDO_USER git clone user@host.com:git-repo $PATH_TO_INSTALLATION
    
  2. As suggested in zwets' answer

    su -lc "git clone user@host.com:git-repo $PATH_TO_INSTALLATION" $SUDO_USER
    

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.