I'm setting up a cloud node (only ssh-accessible, GUIs deprecated, running Debian 7) with 'PermitRootLogin no' for security. For some applications I want to copy some root-owned config files from the remote to local (e.g., to setup a local client). And, for reproducibility, I want to script this (having already hosed things a few times from malformed commandlines). What's best practice to enable getting remote sudo from a script (and, yes, I know I'll hafta type the password--complete non-interactivity would be nice but is not a requirement), given 'PermitRootLogin no' (and no physical access)? Some things I've tried:

(1) scp: fails because I can't tell scp I want to be sudo remotely. (AFAICS--am I missing something?)

(2) naked rsync-path: I tried

me@local ~ $ rsync --rsync-path='sudo rsync' remote:/path/to/file ${HOME}/backups/cloud_9/path/to/file
X11 forwarding request failed on channel 0
sudo: no tty present and no askpass program specified
rsync: connection unexpectedly closed (0 bytes received so far) [Receiver]

Can one enable a non-graphical askpass? Casual DuckDuckGo-ing did not find. Note rsync-path will (IIRC) work with 'visiblepw' but not nakedly/without.

(3) sudoers.d/visiblepw: DDG found

> [sudo-users] Error: sudo: no tty present and no askpass program specified
> Todd C. Miller Todd.Miller at courtesan.com
> Mon Aug 3 10:43:04 EDT 2009

> Recent versions of sudo will refuse to prompt for a password if no tty is present,
> since it is not possible to turn off echo in this case. You can [enable this]
> with a line like:

> Defaults visiblepw

so I created

me@remote:~$ sudo cat /etc/sudoers.d/visiblepw 
> Defaults  visiblepw

which works, but, as noted, echos pw when sudoing remotely ... but now I can, e.g., ssh remote 'sudo whatever' ... as long as no one can see my shell :-)

I'd like to know, is there A Better Way to do this? Am I missing something? Note again, I want it to work from a script.

One more thing (noted while writing), which I found while writing, and haven't tried, because it looks ugly:

(4) mkfifo hoop-jumping: looks ugly and not-quite-scriptable. Am I missing something?

  • Does it have to be all client-side? Otherwise, you could break it into two parts, one where the client scps the files to the cloud node, and a cron job on the cloud node that fixes the permissions, ownership and location of the files. You might have to wait for a minute for the cron job to run, ( or you culd have a cron job which runs every minute, and loops 4 times every 15 seconds using sleep. It should involve a minimum of work, and be fairly easy to diagnose any issues.
    – Warwick
    Sep 23 '14 at 0:54
  • @Warwick: the usecase specifies copying from remote to local, not vv.
    – TomRoche
    Sep 23 '14 at 3:33

A better way to do this might be Ansible - a configuration management tool that interacts with the remotes via ssh. It greatly simplifies the task of ssh authentication and sudo or su on the remote.

With Ansible installed and a host inventory configured, the command to perform this operation is:

ansible remotehost -m fetch -a "src=/etc/sudoers dest=remote-soduers" -u root --sudo --ask-sudo-pass

If you need to configure a bare-bones inventory:

cat > hosts <<EOF
ansible -i hosts remotehost -m fetch -a "src=/etc/sudoers dest=remote-soduers" -u root --sudo --ask-sudo-pass

Alternately, a quick one time command might be accomplished by using the '-t' option on ssh to force pseudo-terminal allocation:

ssh -t remotehost "sudo rsync -av /path/on/remote localuser@localhost:/path/on/local"

This most likely results in two password prompts: one for the sudo, and one for the connection back into the local from root@remote.

  • I am just a coder who needs to set something up for some idiots, not a real admin. I know real admins who very much like Ansible (and Puppet, and even Chef), but ... isn't that a rather big hammer for this particular usecase? I.e., at this point, I'm just trying to get some files off a box.
    – TomRoche
    Sep 23 '14 at 0:41
  • Learning the whole Ansible tool is a big hammer - but if you can apt or yum install it easily, small crisp command lines are possible, and they don't require remote daemons - just ssh access. Added an example above.
    – R Perrin
    Sep 23 '14 at 1:15
  • @R Perrin: "Added [Ansible] example above" Thanks! I'll give that a shot when I get a chance. FWIW, visiblepw suffices for now ... with caveat="check for local physical lurkers first" :-(
    – TomRoche
    Sep 26 '14 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.