4

I want to run a series of sudo-elevated commands on a remote machine from an embedded script. To simplify the question, I'm just trying to run sudo id and get it to tell me that it's root.

I am encountering "sudo: sorry, you must have a tty to run sudo" when I run this script:

#!/bin/bash
ssh -t 192.168.1.100<<EOF
sudo id
EOF

But not when I run this:

#!/bin/bash
ssh -t 192.168.1.100 sudo id

How do I get the first one, with the end-of-file designations for an embedded script to respect the forced tty at the other end of the SSH?

  • I can't change the /etc/sudoers to remove the requiretty and I'm required to use a password to elevate with sudo. – Andy Jun 11 '14 at 22:54
  • also, I am already using the -t option on my ssh, it just that the embedded script within the EOF tags isn't respecting the forced tty – Andy Jun 11 '14 at 22:55
2

With the first one there is no tty for ssh since stdin is not connected to the terminal, it is a here file. In fact if I try to run a similar command (on Debian) I get the following error:

Pseudo-terminal will not be allocated because stdin is not a terminal.

To get it to work you can do something like:

ssh -tt 192.168.1.100 <<EOF
sudo -S id
password
EOF

Although this is not a good idea since the password will be in plain text.

Update

I stumbled across an easy solution to this that avoids encoding the password in plain text, you can use a graphical program to enter the password:

ssh -X 192.168.1.100 <<EOF
SUDO_ASKPASS=/usr/lib/ssh/x11-ssh-askpass sudo -A id
EOF

Of course the ssh-askpass program must be installed in the given location and you must be running an X session on the machine you are working on. There are a few variations on the ssh-askpass program which should also work (Gnome/KDE versions). Also a graphical sudo replacement program like gksu or kdesudo should do the job too.

  • That doesn't work for me either. I get tcgetattr: Inappropriate ioctl for device – Andy Jun 11 '14 at 22:35
  • @Andy, yes, it will since there is no actual terminal but sudo still tries to read the password form it. It is possible to use -S to make it read the password from stdin (not recommended though), see my edit. – Graeme Jun 11 '14 at 22:39
  • It also outputs the password in clear text and still doesn't run the command. – Andy Jun 11 '14 at 22:41
  • @Andy, I had the same effect, yes. It did run the command though. – Graeme Jun 11 '14 at 22:42
  • The answer suggested at serverfault.com/questions/479553/… works for a simple command (like sudo id), but for my more complex scripts, it doesn't interpret correctly. – Andy Jun 11 '14 at 22:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.