In my application I have two servers (private and external) and there is a need for the private server to run a script on the external server at a very high frequency.

To allow this high frequency throughput, I am using ControlMaster to open a persistent ssh connection (without it the external server crashes because of high cpu load as a result of dealing with the authentication).

This is the ssh configuration:

Host <external_host_ip>
  ControlMaster auto
  ControlPath ~/.ssh/cm_socket/%r@%h:%p
  ControlPersist 600
  User user1
  IdentityFile ~/key.pem

This configuration worked for 'user1' user. Unfortunately, it didn't work for me for the 'www-data' user.

Assuming that the root folder for www-data is /var/www, I added the folder cm_socket there, and when I test the connection, I see that something happens there:

$ ll /var/www/.ssh/cm_socket/
srw------- 1 www-data www-data    0 Oct 19 08:49 user1@host_ip:22=

However, it caused apache to crash, and the only thing that help was restarting apache.

UPDATE

/var/www should be the root of www-data:

 $ cat /etc/passwd | grep www
 www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin

This is the /var/www/.ssh/config:

Host <external_host_ip>
    ControlMaster auto
    ControlPath ~/.ssh/cm_socket/%r@%h:%p
    ControlPersist yes
    User user1
    IdentityFile /home/user1/key_wwwdata.pem

content and permissions of /var/www/.ssh:

$ ll /var/www/.ssh/
drwxr-xr-x 2 www-data www-data 4096 Oct 19 08:49 cm_socket/
-rw-r--r-- 1 www-data www-data  198 Oct 19 08:44 config

permission of the key file:

$ ll /home/user1/key_wwwdata.pem
-rw------- 1 www-data www-data 1675 Oct 18 09:11 /home/user1/key_wwwdata.pem

Is there a way to make this solution work for all users (including www-data)?

  • Different user have different home directory and different place for configuration. Do you have the key (key.pem) in his home directory with proper permissions? – Jakuje Oct 19 '16 at 9:07
  • thanks for the answer. I updated the question with the configuration I have for the www-data user, would appreciate if you can take a look (I know that the location of the key_wwwdata.pem is in the file system of user1, but it should have permissions. Could that be the issue? I am a little afraid to try, since it crashed the apache last time I tested – mimusheli Oct 19 '16 at 10:57
  • Well, this is not a good idea. User www-data will not have access to the home directory of the user user1 and if it does, it is plain wrong and ssh will not allow you to use this key. The apache was most probably not crashed, but only hanging in password prompt. – Jakuje Oct 19 '16 at 11:05
  • I understand the security issue. What would you suggest me to do? I need to run a high frequency script on the external server initiated by a button click in the browser – mimusheli Oct 19 '16 at 13:28
  • do you mean that if key_wwwdata.pem would be in /var/www with permission to www-data (same permissions as now), there would be no password prompt and the tunnel will work? – mimusheli Oct 19 '16 at 14:34

The www-data user's shell is usually set to /usr/sbin/nologin which would prevent ssh logins.

You could try changing www-data's shell by running:

sudo chsh www-data

And entering /bin/bash as the new shell value.

  • Thanks for the useful tip. I needed to do composer update using the root account. Composer warns you for updating as root for obvious reasons. So @Weboide's method is very useful. Additional step after chsh www-data was su www-data. Then ran composer update and exit to get back to root. – ATutorMe Aug 17 '17 at 6:42

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.