1

I have two servers, serverA and serverB.

At present I run a shell script on serverA that creates a file and 'pushes' it to serverB. The shell script runs as a cron every hour and requires SUDO privileges.

However, due to changes in our setup, I can no longer 'push' the file from serverA to serverB, and instead I now need to 'pull' the file from serverB to serverA.

Is there a 'correct' way of connecting to a remote server and executing a script that requires elevated privileges? but without having to write down the password in the shell script on serverB?

  • 2
    The correct way would likely be to use sudo, then allow the correct user to run the correct script without a password in /etc/sudoers. – Tom Hunt Oct 27 '15 at 16:39
  • 1
    This is a great example of why people use 'puppet'. – Jeight Oct 27 '15 at 19:11
2

You have some choices. Here are some suggestions:

  1. Connect from serverB to root@serverA using certificate based authentication and run the script within the root context on that server.

    You can then use that same certificate based authentication to pull the resulting file back with scp or rsync. The downside is that your account on serverB then has full unmitigated access to root@serverA. however, in a closely managed environment this may be acceptable.

  2. Connect from serverB to root@serverA using certificate based authentication that limits the connection to running a single command - your script.

    If the command were to output its file to stdout it could be captured directly from the ssh session from serverB to root@serverA with no need to transfer the file after script completion. Your account on serverB would not have arbitrary access to root@serverA.

    An example of the necessary entry for root@serverA in its ~root/.ssh/authorized_keys file to run the bake command might look a little like this:

    ssh-rsa AAAAB3Nza...Fr9FvN me@roaima,command="/usr/local/bin/bake",no-agent-forwarding,no-port-forwarding,no-X11-forwarding
    
  3. Connect from serverB to serverA, and use sudo to run the script. You can configure sudo to allow your single user account to run the script as root but without requiring a password.

    This entry in /etc/sudoers would allow user "roaima" to run the named script with or without arguments as root using a command such as sudo /usr/local/bin/bake --fruit=apple,blackberry --type=pie

    roaima ALL = NOPASSWD: /usr/local/bin/bake
    
  4. More complicated things with triggers, such as connecting to a defined TCP port on serverA and having that trigger your script, run as root.

    This does mean that anyone who can access that TCP port on serverA can start your script, so you need to consider DDOS issues and preventing multiple instances of the script being run simultaneously. However, it would remove the need to have any interactive root access on serverA -- even that mediated with sudo.

  • 1
    for option 1, /root/.ssh/authorized_keys on serverA can be configured so that a particular key can only run certain commands. – cas Oct 27 '15 at 22:21
  • @cas ah, now you mention it, yes that's absolutely correct. I've used that feature so rarely (once? twice?) I keep forgetting about it. I'll update the answer, thank you. – roaima Oct 27 '15 at 22:27
  • 1
    easiest way would be for the allowed command on serverA to just generate and/or cat the file to stdout and the script on serverB to capture ssh's output. no need to bother with scp :) – cas Oct 27 '15 at 22:32
  • cheers for some useful ideas. 2 and 3 in particular look promising. Am I right in thinking that in 2, the script would be located on serverB and in 3 the script would be located on serverA? – IGGt Oct 28 '15 at 14:01
  • @IGGt the hypothetical bake script would be on serverA in both cases. I'll fix the typo in #2 – roaima Oct 28 '15 at 18:02
1

You can connect to serverB via ssh, then run sudo to execute your script with elevated privileges. You can configure sudo not to ask for a password.

  • that sounds dangerous telling sudo not to require a password? or maybe I'm overthinking it. – IGGt Oct 27 '15 at 16:50
  • 1
    @IGGt you can configure sudo to allow just the script to be run without requiring a password. – roaima Oct 27 '15 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.