Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'd like to do something like:

scp local_file remote_server:/some_directory

But in order to gain privileges to /some_directory, we need to call sudo. I know that a similar question had already been asked quite a few times here, but most of the answers either took advantage of sudo's password caching (which for some reason doesn't seem to work for me in two consecutive ssh calls) or the fact that we're root (so we can set up a passwordless sudo or make SSH let in root).

In the latter, both of the solutions seem insecure, so I'd rather like to assume that we're not calling sudo to become root and thus can't reconfigure the system. What can be done in such a situation to simply copy a file?

Here are my attempts so far:

( 
read -s -p 'Enter password: ' pass; 
echo $pass ; 
tar cf - local_file ) | ssh -t -t remote_server 'sudo tar -C /some_directory' )

Is there a better way?

share|improve this question
    
Is it possible to turn it around and ssh to the remote system, sudo to the user, and scp the file from your local system? –  slm Apr 10 at 23:02
    
Another approach: notepad.bobkmertz.com/2008/04/… –  slm Apr 10 at 23:04
    
@sim: turning it around would be an option, but let's assume that there's no SSH server on the local machine. About the rsync trick - is it safe? Can the passwordless rsync be taken advantage of in order to escalate privileges using some command-line switch? –  d33tah Apr 10 at 23:06
    
The rsync method would expose the ability to rsync to a particular user w/o having to challenge them when they run sudo. The ability to gain access to the box would be guarded by SSH only. It could be more localized by limiting the ability to use this sudo rule by scoping it to a single user for this task. –  slm Apr 10 at 23:10
    
If that's too open, you can give rsync the command you want to run by wrapping the sudo inside the -e arg. See this Q&A: stackoverflow.com/questions/21639906/… –  slm Apr 10 at 23:11

1 Answer 1

I have found an elegant way to work around those issues using a named pipe. The idea is to run your tar command on the remote side through a FIFO socket and make that socket readable by your regular user.

Here is an example. On the remote side, you first create the socket:

remote$ sudo -s 
remote# mkfifo -m 600 /home/anarcat/tmpfifo
remote# chown anarcat /home/anarcat/tmpfifo

On the local side, you can already start reading that socket:

local$ ssh example.net "cat tmpfifo" | pv -s 2G | tar xfz -

(The pv -s 2G | part is entirely optional, to get a nice progress bar with pipe viewer.)

Then on the remote side, you can start writing to it:

remote# tar cfz /home/anarcat/tmpfifo files

This will copy files over through that SSH connexion. Of course, you could have also created that tarball directly on the remote server and made it accessible to the user, but then it would require all the space of the archive, which may not be available.

Once this is done, you can remove the fifo as a simple file:

remote$ rm /home/anarcat/tmpfifo
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.