Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a script that logs into a remote host via ssh -t and uses sudo service foo restart.

The requirement is to avoid the prompt for a password on the remote host. The remote host authenticates via SSH certificate. The sudoers file on the remote host allows that user to execute the service command with NOPASSWD.

However, during my tests, I'm prompted for a password and this is unacceptable. If I run this manually without the -t flag, it works. However the -t flag throws everything off.

Is there a way around this?

share|improve this question
    
What do the authentication logs say? Typically auth.log or secure in /var/log. – jordanm Jun 26 '13 at 2:10
    
Are you sure that NOPASSWD is set? Remember that only the last match in sudoers counts. Also remember that if sudo doesn't prompt you for a password, it can be because of the cache, so make sure to flush it before each test with sudo -k. – Gilles Jun 26 '13 at 23:39

Maybe disabling the requiretty option in sudoers and running ssh without the -t flag (or with -T) works.

Add something like this to sudoers (untested):

Defaults:{your ssh user} !requiretty

Combine that with the NOPASSWD you're already using and you should be able to run the sudo command without a pseudo-tty allocated.

You could also change requiretty for the command instead of the user.

share|improve this answer

Generate an SSH key and transfer it to the remote host.

  1. Use the following command to generate an RSA SSH key

    [root@localhost ~] ssh-keygen
    
    Generating public/private rsa key pair.
    Enter file in which to save the key (/root/.ssh/id_rsa):  Hit ENTER
    Enter passphrase (empty for no passphrase): Hit ENTER
    Enter same passphrase again: Hit ENTER
    
  2. Find /root/.ssh/id_rsa.pub and transfer that key to remote using the following command:

    ssh-copy-id -i /root/.ssh/id_rsa.pub root@remote:/root
    

Now try to login; it won't ask for your remote password.

share|improve this answer
    
We already have the ssh keys in their proper place. That part works. There's something about how ssh -t created a pseudotty that is affecting my ability to execute sudo commands where the user has NOPASSWD enabled. What's happening is that this script logs into a server, parses a list of severs that are our middleware servers, then does a ssh -t "sudo service middleware restart" operation via shell script. The problem is that when the script iterates through the list, user is prompted for password despite NOPASSWD set in the sudoers file. – dperry1973 Jun 26 '13 at 12:22

For me worked fine like this, but with notice about: Pseudo-terminal will not be allocated because stdin is not a terminal

ssh -t username@hostname1 << 'EOS'
sudo sh
hostname
EOS

Pseudo-terminal will not be allocated because stdin is not a terminal.
hostname1
share|improve this answer
    
But you need key pair for it, if key pair with passphrase, you can use keychain – Ragnar Lodbrog May 19 at 7:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.