I need to redirect some strings to a fifo file with ssh remote command, but always got permission denied, the command I executed is:

ssh rundeck@nagios1 sudo su - root -c 'printf "Disable_Notification;web01;App:Tomcat:Log:webapp" >> /opt/nagios/nagios.cmd'

Then got this error:

bash: /opt/nagios/nagios.cmd Permission denied

The file permisson of nagios.cmd is:

prw-rw---- 1 nagios nagios 0 Mar  16 10:32 /opt/nagios/nagios.cmd

However I can successfully execute this command while I logged in to nagios1 as rundeck user with sudo command:

sudo su - root -c 'printf "Disable_Notification;web01;App:Tomcat:Log:webapp" >> /opt/nagios/nagios.cmd'

The nagios1 is running RHEL5, SELinus is set to Permissive. I don't see any log output(message and secure) while execute the command remotely.

  • 1
    You're missing a layer of quotes, I think: sudo 'su -c '\''printf ..."...">> /...'\''' – mikeserv Mar 6 '15 at 14:11

SSH runs a shell command. It concatenates its parameters with spaces in between and runs that command remotely. Thus when you type this in your local shell

ssh rundeck@nagios1 sudo su - root -c 'printf "Disable_Notification;web01;App:Tomcat:Log:webapp" >> /opt/nagios/nagios.cmd'

this is what is executed in the remote shell:

sudo su - root -c printf "Disable_Notification;web01;App:Tomcat:Log:webapp" >> /opt/nagios/nagios.cmd

As you can see the redirection is applied in the outer remote shell invoked by sshd, not in the inner shell launched by su. You need an additional layer of quoting: one to protect special characters from the local shell so that they reach the remote shell, and one to protect special characters from the outer remote shell so that they reach the inner remote shell invoked by su (plus a third around the string to print so that it goes through that inner shell).

ssh rundeck@nagios1 'sudo su - root -c '\''printf "Disable_Notification;web01;App:Tomcat:Log:webapp" >> /opt/nagios/nagios.cmd'\'

You can do with one less level of quoting by doing the printing in an unprivileged shell and piping it through to a privileged command (which doesn't need to be a shell) that just writes to the file.

ssh rundeck@nagios1 'printf "Disable_Notification;web01;App:Tomcat:Log:webapp" | sudo tee /opt/nagios/nagios.cmd'

And you can even do the printing locally which eliminates another level of necessary quoting.

printf "Disable_Notification;web01;App:Tomcat:Log:webapp" | ssh rundeck@nagios1 sudo tee /opt/nagios/nagios.cmd

And instead of using print … | … you can use a here string (assuming your local shell is ksh, bash or zsh).

ssh rundeck@nagios1 sudo tee /opt/nagios/nagios.cmd <<<"Disable_Notification;web01;App:Tomcat:Log:webapp"

Refer to this answer, combined with some other sudo and ssh flags to allocate a Pseudo TTY.

ssh -t rundeck@nagios1 "sudo -u root sh -c 'printf \"Disable_Notification;web01;App:Tomcat:Log:webapp\" >> /opt/nagios/nagios.cmd'"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.