Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a script that logs into a remote host via ssh -t and uses sudo service foo restart.

The requirement is to avoid the prompt for a password on the remote host. The remote host authenticates via SSH certificate. The sudoers file on the remote host allows that user to execute the service command with NOPASSWD.

However, during my tests, I'm prompted for a password and this is unacceptable. If I run this manually without the -t flag, it works. However the -t flag throws everything off.

Is there a way around this?

share|improve this question
    
What do the authentication logs say? Typically auth.log or secure in /var/log. –  jordanm Jun 26 '13 at 2:10
    
Are you sure that NOPASSWD is set? Remember that only the last match in sudoers counts. Also remember that if sudo doesn't prompt you for a password, it can be because of the cache, so make sure to flush it before each test with sudo -k. –  Gilles Jun 26 '13 at 23:39
add comment

2 Answers

Maybe disabling the requiretty option in sudoers and running ssh without the -t flag (or with -T) works.

Add something like this to sudoers (untested):

Defaults:{your ssh user} !requiretty

Combine that with the NOPASSWD you're already using and you should be able to run the sudo command without a pseudo-tty allocated.

You could also change requiretty for the command instead of the user.

share|improve this answer
add comment

Generate an SSH key and transfer it to the remote host.

  1. Use the following command to generate an RSA SSH key

    [root@localhost ~] ssh-keygen
    
    Generating public/private rsa key pair.
    Enter file in which to save the key (/root/.ssh/id_rsa):  Hit ENTER
    Enter passphrase (empty for no passphrase): Hit ENTER
    Enter same passphrase again: Hit ENTER
    
  2. Find /root/.ssh/id_rsa.pub and transfer that key to remote using the following command:

    ssh-copy-id -i /root/.ssh/id_rsa.pub root@remote:/root
    

Now try to login; it won't ask for your remote password.

share|improve this answer
    
We already have the ssh keys in their proper place. That part works. There's something about how ssh -t created a pseudotty that is affecting my ability to execute sudo commands where the user has NOPASSWD enabled. What's happening is that this script logs into a server, parses a list of severs that are our middleware servers, then does a ssh -t "sudo service middleware restart" operation via shell script. The problem is that when the script iterates through the list, user is prompted for password despite NOPASSWD set in the sudoers file. –  dperry1973 Jun 26 '13 at 12:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.